Normally in the model; but often in Rails the "model" gets conflated with the "persistence layer." Many of us who develop in Rails feel that the persistence layer should have the single responsibility of persistence, and would like to use something like a DAO pattern there, keeping business objects / logic in pure Ruby classes.

Note that this is not necessary for small, simple Rails applications: by all means, if you're writing a blog app, stick everything in AR::Base and don't over-design. But once you start working in large-scale, non-trivial Rails apps, it becomes very painful to have to have all of your tests running against your database for example.

This is probably something of an idiosyncrasy of Rails, and may have little relevance to other frameworks / languages.