Careful, I don’t think there’s a download-and-run image. The plans page says on-premises installs are agreed with their sales team, same as Enterprise plans, so that’s a conversation, not a button.
For the other two questions you can answer him today, I did exactly this for our compliance people:
Where the data is: every organisation has one home region, EU, US or Turkiye, picked when it was created. Devices, telemetry, alarms, boards, flows, audit log all live there. As owner or admin open Settings, then Residency (it’s at /admin/settings/residency). It shows the home region, any residency requirement, the region facts, the sub-processors and where backups are kept. I screenshotted that page and that was most of the answer.
Getting it out is two parts. An owner can pull a JSON export of the organisation (devices, boards, members, settings, webhooks, part of the audit log). Telemetry history goes separately, with the history API or the download on a chart card, and board files you download one board at a time. I wrote a little script that pulls hourly averages per device into CSV every month, so we always have our own copy.
Page I sent our IT: Regions and data residency, plus the “Export your data and close your organisation” one.