What is data residency?
Data residency refers to the physical location where data is stored and processed. When we talk about "EU data residency," we mean that data remains within the borders of EU member states at all times — during storage, processing, and transmission.
This is different from "data sovereignty," which refers to the legal jurisdiction governing the data. Ideally, you want both: data physically located in the EU and subject to EU law.
Why does data residency matter?
Legal compliance
Several EU regulations and directives require or strongly encourage EU data residency:
- GDPR — while it doesn't explicitly mandate EU storage, it restricts transfers to countries without "adequate" data protection. The Schrems II ruling made transfers to the US particularly problematic.
- ePrivacy Directive — additional restrictions on electronic communications data
- Sector-specific regulations — healthcare (national health data laws), financial services (EBA guidelines), public sector (national procurement rules)
Risk management
Even where not legally required, EU data residency reduces risk:
- No CLOUD Act exposure — US law enforcement cannot compel access to data held by EU companies on EU infrastructure
- Regulatory predictability — EU data protection law is mature and well-understood
- Customer trust — EU businesses increasingly prefer EU-hosted tools
Practical enforcement
EU Data Protection Authorities are actively enforcing data residency:
- Austrian DPA ruled Google Analytics illegal (January 2022)
- French CNIL followed with the same ruling (February 2022)
- Italian Garante issued similar rulings
- German DPAs have been particularly strict on US data transfers
What "EU-hosted" really means (and doesn't)
Not all "EU-hosted" claims are equal:
| Claim | Reality |
|---|---|
| "We have EU servers" | Data may be stored in EU, but US parent company can still access it under CLOUD Act |
| "We use AWS Frankfurt" | AWS is a US company — data on AWS is subject to US jurisdiction regardless of server location |
| "We're GDPR compliant" | Compliance claim doesn't guarantee EU-only data processing |
| "EU data residency" | Should mean data is stored AND processed exclusively in the EU by an EU entity |
The key question to ask any SaaS vendor: "Is your company, and every subprocessor in the chain, incorporated in the EU?"
How to audit your current tools
Go through every SaaS tool that touches personal data and ask:
- Where is the company incorporated?
- Where are the servers located?
- Who are the subprocessors? (Request the list — they're required to provide it under GDPR)
- Is there a Data Processing Agreement available?
- Can you get documentation of EU-only processing?
Tools that commonly fail this audit: form builders, analytics, email marketing, CRM, customer support, file storage.
FormGuard's approach to data residency
FormGuard is built from the ground up for EU data residency:
- Servers in Frankfurt, Germany — data is physically stored in the EU
- EU hosting provider — incorporated in Lithuania (EU member state)
- No US infrastructure — we don't use AWS, Google Cloud, Azure, or any US provider
- No US subprocessors — the complete data processing chain is EU-only
- Verifiable — we'll tell you exactly where your data is and who can access it