Keeping your data in the EU when you use AI

If you handle information about customers, patients, students or employees in Europe, the question "where does my data go when I use an AI tool?" is not a technicality. It affects your legal duties, your customers' trust and what you can promise them. It is also a question where marketing language is often vague.

Below, you will find what data residency means, where AI makes it more complicated, and what a small business should check to keep its data in the EU when it uses AI. It is general information, not legal advice. For decisions with real consequences, speak to a data protection professional where you are.

What people mean by "data in the EU"

When a vendor says your data is in the EU, they usually mean one of several different things. They are not the same:

• Storage. Your files, conversations and logs sit on servers in the EU.
• Processing. The computation happens in the EU, for example an AI model reading your text to write an answer.
• Access. Who can read the data, and from where. Staff outside the EU with access are a different matter from staff inside it.
• Backups and logs. Copies and records can sit somewhere other than the main store.
• Sub-processors. The other companies the vendor uses, each with their own locations.

A claim that covers only storage leaves a lot of questions open. That is why the next section matters.

Why AI makes it harder

With an ordinary web app, your data is stored in one place and used by that app. With AI, there is an extra step: your text is sent to a model, and the model may run somewhere else, run by another company.

So when you ask an AI tool a question about a contract, several things happen:

1. Your documents are stored with the vendor.
2. The relevant passages are retrieved.
3. Those passages, with your question, are sent to a model provider.
4. The provider processes them, in a location you may not have chosen, and returns the answer.

A tool can store everything in Germany and still send text for processing to a model in the United States. Neither fact is automatically wrong, but you need to know both. Under the GDPR, transfers of personal data outside the EU need a legal basis and safeguards.

What to ask any AI vendor

Put these questions to any provider, and expect clear written answers:

1. Where is my data stored, and where is it processed? Ask separately.
2. Which AI providers receive my text, and where do they process it? Ask for the list.
3. Is my content used to train models? By you, and by them.
4. How long is it kept, and can I set the period?
5. Can I export and delete everything, including from backups, and how long does deletion take?
6. Who are your sub-processors? Can I have the list?
7. What happens in a breach? How and how fast will you tell me?
8. What certifications do you hold? And be wary of claims you cannot verify.

An answer such as "we take privacy very seriously" is not an answer. A specific one is: a place, a period, a list.

What nerix does, and what it does not

We would rather be exact than reassuring, so here is what is true today.

• Storage and processing in the EU. nerix runs on servers in France, with files and backups in the Netherlands. Today the European Union is the one region. United Kingdom and United States capacity is not live yet, and the Security page will say so on the day it is.
• Providers differ, and you choose. An organisation chooses which AI providers may process its content. A new workspace is EU only: Mistral, which processes in France, and models on nerix's own server. Other providers, such as Anthropic and Google, process elsewhere and stay off until an administrator allows them, and DeepSeek's own API processes data in China, which nerix flags with a caution. An owner can lock the workspace to its region. Names of the people and clients the workspace knows are replaced with codes before text reaches any provider.
• No training on your content. nerix never uses your documents to train a model, and neither does Mistral. The product shows what each other provider may do before you allow it.
• Redaction. Names, email addresses and account numbers can be replaced with placeholders before text is sent to a provider. It cannot catch everything, so it reduces exposure and is not a guarantee.
• Retention and erasure. Retention is set per organisation. Erasure takes effect within 30 days, including in backups, and you can export a machine-readable copy of your content.
• Audit log. An append-only record that nobody, including an owner, can edit.
• What we do not have. nerix does not yet hold SOC 2 or ISO 27001, and says so. The public API is not live yet.

The Security page and the sub-processor list give the details, and the sub-processor register is available on request.

A checklist for your own business

Whatever tools you use, run through this once:

Know what personal data you hold

List the kinds of personal data your business handles: customer contact details, orders, support messages, employee records. You cannot protect what you have not listed.

Know why, and for how long

Under the GDPR, you need a reason for each use of personal data, and you should keep it no longer than needed. Write down the reason and the period for each kind.

Choose tools deliberately

For each tool that touches personal data, note where it stores and processes it, who the sub-processors are, and whether a data processing agreement is in place. Prefer tools that answer this clearly.

Limit what goes into AI

Do not paste into any AI tool what the task does not need. If you are summarising a complaint, you often do not need the customer's full name and address. Use the redaction option where it exists, and be careful with special categories of data such as health information.

Tell people what you do

Your website needs a privacy notice that says what you collect, why, how long you keep it, who receives it, and how to exercise their rights. Our website privacy notice template is a careful starting point, and you should check it against what you actually do.

Be ready for requests

People have the right to ask what you hold about them and to ask for it to be deleted. The usual deadline for a reply is one month, though it can vary. Our personal data access request and personal data deletion request templates show what such requests look like, which helps you recognise and handle them when they arrive.

Keep a record

Write down your decisions: which tools, which providers, why. If a customer or an authority asks, you can show your reasoning.

Common misunderstandings

• "EU hosting means compliant." It does not. It helps with one question among many.
• "Anonymised, so it does not count." Genuinely anonymous data is outside the GDPR, but removing a name is often not enough to make data anonymous.
• "The vendor is responsible." Vendors have duties, and so do you. You decide why and how personal data is used, and that brings your own obligations.
• "We will fix it when someone asks." Fixing it afterwards is slower and costlier than choosing well at the start.

When to get help

A small business can handle the basics with a clear list and a few good templates. Get professional advice when you process sensitive categories of data, handle data about children, transfer data outside the EU on a large scale, or have been asked a difficult question by a regulator or a large customer. A data protection officer or a lawyer who knows your sector earns their fee in those cases.

The short version

Ask where data is stored and where it is processed, and treat them as two questions. Find out which AI providers see your text and where they run. Make sure your content is not used for training. Share only what the task needs. Keep a short record of your choices. And remember that location is one piece of data protection, not the whole of it.