Where in code validate/sanitize inputs?

For example, I use separate classes - services for business logic.
The models in my implementation are repositories (working only with the database).