I think you can answer IT that QGIS simply do not store any data, it's a tool that let you access, display, create, analyse and manage data but has no data storage component.
When you access existing data it may be stored anywhere, if that's a concern you will need to check if each individual datasource follow your requirement (could be hard to know where the server is/are located)
When you create new data they will need to be stored somewhere, either as file (on a server or on any other storage media) or in a database but you retain full control on where you choose to store the data