What 'we host in the EU' really means, and what it does not

Until recently our own site said that we do not use American data centres. That was not true.

Not because we were lying, but because we had written that sentence with one product in mind and then left it standing across the whole site. Meanwhile, logging in with us runs through Google and Microsoft, one of our tools runs on Gemini, and our own website measures with Google Analytics. All American.

That sentence is gone. What is there now is true.

Why this goes wrong so often

"We host in the EU" is usually true and usually incomplete. There are four different layers in an AI tool, and all four of them can sit somewhere else.

The server the application runs on. This is what people mean by hosting. Often Frankfurt or Amsterdam, indeed.

The database. Usually with the same party, but not always. Check it separately.

The AI model. This is where it gets interesting. A European endpoint from an American provider is a different thing from a European provider. And some models are not available in Europe at all.

Everything around it. Logging in, sending mail, statistics, error reporting. This is the layer everybody forgets, and it is precisely the layer where most of the American services sit.

Anyone who says there is no American service in there usually has not looked hard enough.

Four questions for your supplier

1. Give me the list of sub-processors. Not "we host in the EU", but a table: which service, what for, where it is based, which data passes through it. If the supplier cannot deliver that within a day, it does not exist.

2. Which model exactly, from which provider, on which endpoint. "We use AI" is not an answer. "Mistral, France" is. "Anthropic via the European endpoint" is too.

3. Is my data trained on? With most business APIs it is not, but that is in the terms and not in the sales talk. Have them point it out.

4. How long is what kept, and what happens if I stop? Per category. Calendar data, conversation records, log files, invoices. With us that is ninety days, as long as your account runs, ninety days and seven years respectively, because the tax office requires that last one.

What an honest answer looks like

Not: "everything stays in Europe."

But: "your content sits in Frankfurt and the AI comes from France. Logging in runs through Google or Microsoft, because that is what you want yourself. Our website measures with Google Analytics, and only after you have clicked accept. Those are American services, and here is which data passes through them."

That second answer is longer and less slick. It is also the only answer that holds up in an audit.

Why we are writing this down

Because we had it wrong ourselves. And because the GDPR does not demand perfection but it does demand transparency: you may use American services, as long as you are open about it.

Our own list is on Where your data sits. Nine lines, per service what it does and where it sits. If you ask your current supplier for a list like that and you do not get one, you know enough.