What is data residency?
Your Postgres instance sits in Frankfurt. The prompt you send to a model API can still leave the EU on every request. Nothing in your database config would show you that.
Data residency
data localization
Data residency is the physical place where an organisation's data is stored, and the laws that apply to it because of that place. It answers one question: can a court in that country force access to this data?
Residency and localization get used as synonyms. They are not the same claim. Residency describes where data sits right now. Localization is a legal rule that it must stay there. Russia's Federal Law 242-FZ and China's Personal Information Protection Law both make certain data stay on servers inside the country. GDPR does not do that. It just needs a safeguard for data that leaves the EU. Mixing the two up leads a team to over-build for a rule that does not apply, or under-build for one that does.
Most teams check this for their database and stop. A managed Postgres instance pinned to an EU region satisfies the storage half of the question. It says nothing about a call your application makes to a language model hosted somewhere else. That is where the AI-specific gap opens up.
An AI feature adds a second location to check
A residency review built for a normal application checks one thing: where the database lives. That check used to be enough. The database was the only place customer data went.
An AI feature breaks that assumption. Every prompt sent to a model API carries whatever context you gave it. Often that is a customer's name, a medical note, or a full support ticket. That prompt is a data transfer, and it can cross a border your database never does. OpenAI's own API terms name server locations outside the EU as the default. A customer has to turn EU data residency on, where the provider even offers it. Not every provider does.
The honest question is not "where is our data stored". It is "where does our data go on every hop, including the one to the model". Storage, backups, and inference each answer that separately. A review that checks only storage has skipped the part a regulator actually asks about.
- Primary storeDatabase region, the usual first check.
- BackupsOften replicated to a second region by default.
- Inference callWhere the model API actually runs the request.
- Provider logsPrompts retained for abuse monitoring, on their terms.
- Sub-processorsWhoever the vendor's vendor is.
Most audits stop at the first node. AI adds the inference call.
Residency against the terms it gets mixed up with
| Criterion | What it actually means | The mistake teams make |
|---|---|---|
| Data residency | Where data sits, and which laws apply because of that. | Treated as satisfied once the database region is picked. |
| Data localization | A legal requirement that specific data must not leave a country. | Assumed to apply everywhere, when only some jurisdictions mandate it. |
| Data sovereignty | Data governed by the laws of the country it is stored in, regardless of who owns the storage. | Confused with residency, though a foreign-owned provider can still host data under local sovereignty law. |
| Encryption at rest | Protects data if a disk is stolen. Does not change which country's courts can compel access to it. | Cited as if it were a residency control, when it is a separate protection. |
Common questions
01Does GDPR require EU data to stay in the EU?
No. GDPR does not mandate that personal data physically remain in the EU. A transfer outside the EU needs an approved safeguard, like standard contractual clauses, so the data stays protected wherever it goes. Keeping data in-region is one way to satisfy that. It is not the only way.
02Where does my AI data actually go when I use a model API?
Most model APIs process requests wherever their infrastructure runs, and that is not always the region your customers are in. Some providers offer region-pinned or EU-specific processing as an opt-in setting or an enterprise tier. Check the provider's data processing terms for the specific region named. Do not assume it matches your database.
03Is self-hosting a model the only way to guarantee residency?
It is the most direct way, because it removes the third-party inference hop entirely. It is not the only way. A managed provider offering a contractual, region-pinned processing location can satisfy the same requirement without you running the model infrastructure. Which one is right depends on the regulation you are answering to and what your team can realistically operate.
04Does encrypting data at rest solve residency?
No. Encryption protects data if storage media is lost or stolen. It does not change which country's courts can compel access to it, because jurisdiction follows the physical location and the operator, not the encryption state. Residency and encryption are separate controls, and both matter.
Related
- Self-hosted vs managed LLM →The trade-off behind the self-hosting option this page names.
- Is your AI build EU AI Act compliant →The regulation most likely to make residency a hard requirement.
- Healthcare software development →Where patient data location is checked on every build, AI features included.
