Our institution wants to be sure that our data is kept in house when using the standard ArcGIS basemaps services (Topo, Streets, etc). Does anyone know for certain the answer to that question?
We have feature classes built in house that are stored on our internal ArcGIS server so we know those queries are not a problem. The question comes when we use the basemaps from ArcGIS online. The basemaps provided in our package do not scale down low enough so that is why we are using these basemaps from the online site.
I have an open case trying to find the answer to this question as well but thus far they have been unable to totally understand my question.
I believe the answer to your question is that your ArcGIS Server services and the AGOL Basemaps have no data interaction. The basemap is a single contained service coming from Esri's servers and your services are contained and coming from your ArcGIS Server. Can you elaborate on your data publishing workflow a little more? WIthout some more information I can't see a way that your internal data would be at risk.
We have a web application that uses feature services stored on our internal ArcGIS services. Due to the limitations of the basemaps we have in house, we are using the services from AGOL to support the underlying basemaps in our app. To me it seems that our internal data is secure but I need to be 100% sure. Does that help? I guess what I really need is ESRI to weigh in on this and confirm that the data is secure with this type of model.