Abstract: A distributed application infrastructure to run business logic routines on data stored on different computer systems has a security module that limits where data can be transferred to within a single application that spans multiple computer systems. The data can be designated as private, which means that the data is never transferred from its home computer system, or as public, which means that the data could be transferred to any other computer system running the distributed application, or as protected, which means that the data could only be transferred to pre-designated computer systems running the distributed application.