It’s both. I suspect most of their focus is on data retention; regardless of where it happens.
Most times, that’s usually a server, of some kind, but it could also be something like an iCloud data account, I guess; which would be a challenge, as the data could be in many places.
