“Data in the EU”: what data residency really means

“Our data is in the EU” is one sentence. Where it is processed, backed up and accessed are four questions.

“Our data is in Frankfurt.” You find this sentence on many software providers' websites – and it is often true. But it answers only one of several questions. Where is data processed? Where does the AI model run? Where are backups and logs? Who has access, and from where? And where is the provider headquartered?

Especially with AI services in IT support, the answers often diverge. Here is what is behind the term data residency and which questions you should ask providers. Note: general guidance, not legal advice.

Data residency has several layers

• Layer: Storage – Question: Where is the data kept permanently?; Typical pitfall: EU storage, but …
• Layer: Processing – Question: Where is it processed?; Typical pitfall: … requests go to servers outside the EU
• Layer: Backups – Question: Where are the backups?; Typical pitfall: Backup region differs from primary region
• Layer: Logs and telemetry – Question: Where do logs, error reports and usage data end up?; Typical pitfall: central logging outside the EU
• Layer: Support access – Question: Who accesses data from where?; Typical pitfall: Support team in a third country with full access
• Layer: Subprocessors – Question: Which other services are involved?; Typical pitfall: Email delivery, analytics, translation in third countries
• Layer: Legal jurisdiction – Question: Where is the provider headquartered?; Typical pitfall: EU data center, but a US parent company

Only when all layers are answered do you know where the data really is.

Why does the provider's headquarters matter?

Because of laws such as the US CLOUD Act. Under this 2018 law, US authorities can, under certain conditions, request data from US companies – even if that data is in a data center in the EU. Whether and how often that happens in practice is disputed; for some industries and types of data, even the possibility is an exclusion criterion.

That does not mean US providers with an EU data center are not permitted. With a data processing agreement, safeguarded transfers – for example via the EU-US Data Privacy Framework or standard contractual clauses – and technical protective measures, their use is common. It is a risk assessment that many companies make differently depending on the type of data.

Special case AI: where does the model run?

With AI services, the most important question is often not “Where is it stored?” but “Where do the requests go?”. A chat history in IT support contains names, devices, error messages, sometimes screenshots. If every message is sent to a language model outside the EU, that data leaves the EU – even if the history is afterwards stored in Frankfurt.

Also ask:

• Is input used for training? In a business setting, that should be ruled out.
• How long does the model provider store requests (for example for abuse detection)?
• Is data redacted beforehand? Passwords and tokens should never reach the model in the first place.

The question list for providers

1. Where is data stored – region, data center?
2. Where is it processed – even temporarily?
3. Where does the AI model run, and who operates it?
4. Where are backups, logs, telemetry?
5. Who has support access – from where, with what permissions, is it logged?
6. Which subprocessors are there, in which countries?
7. Is data used for training?
8. Where is the provider headquartered, is there a parent company outside the EU?
9. How are transfers to third countries safeguarded?
10. What happens to the data at the end of the contract?

The answers belong in the data processing agreement and the list of subprocessors – not just on the website. More on the agreement: GDPR for AI support.

What does this mean for MSPs?

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

MSPs use many tools at the same time – RMM, PSA, remote support, documentation, backup, AI. Each of them processes customer data. Customers that fall under NIS2 or work in regulated industries increasingly ask about it. An overview helps:

• Tool: RMM – Provider/headquarters: …; Storage location: …; Model/processing: …; Subprocessors: …
• Tool: PSA – Provider/headquarters: …; Storage location: …; Model/processing: …; Subprocessors: …
• Tool: Remote support – Provider/headquarters: …; Storage location: …; Model/processing: …; Subprocessors: …
• Tool: AI support – Provider/headquarters: …; Storage location: …; Model/processing: …; Subprocessors: …

That makes it easy to answer a customer questionnaire. See also NIS2 for MSPs.

Data residency is not an end in itself

For some data, EU data storage is mandatory or a customer requirement, for other data it is a trade-off. What matters is to make the decision consciously and document it – rather than relying on “data center in Frankfurt” without knowing the other layers.

In our comparisons with other providers, we addressed this each time – for example in rezolve.ai, Moveworks or Zendesk.

What is it like with SuperSupport?

Which subprocessors are involved, how long data is stored and how transfers are regulated is set out in the contract documents – not just on the website. How that looks for internal IT teams and MSPs is explained on the respective pages.

Frequently asked questions

What does data residency mean?

Data residency describes in which country or region data is stored and processed. For many companies in the DACH region, it is important that personal and business data stays in the EU.

Is a data center in the EU enough?

Not always. Besides the storage location, the place of processing counts – for AI services, for example, the location of the language model – as do backups, logs and support access. A provider can store in Frankfurt and still send requests to a model in the US.

What is the CLOUD Act?

A US law from 2018 under which US authorities can, under certain conditions, request data from US companies – even if that data is stored outside the US. That is why the provider's headquarters matters in addition to the storage location.

Can a US provider with an EU data center be used in compliance with the GDPR?

In principle yes, with a data processing agreement, safeguarded transfers, for example via the EU-US Data Privacy Framework, and suitable protective measures. The decision is a risk assessment that many companies make differently depending on the type of data.

Which questions should I ask a provider?

Where is data stored, where is it processed, where are backups and logs? Where does the AI model run? Who has support access, and from where? Which subprocessors are there? Is data used for training? Where is the provider headquartered?

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial