Resource · Security questionnaires
Where AI vendors say they keep your data
Two kinds of sentence answer that question and they look almost identical. One promises a place. The other names a place inside a list of everywhere else. Both are quoted below, kept apart, with the page each came from and the date we read it.
Both sentences name a country. Only one is a promise.
A commitment. “Airtable offers our customers the option to have their data stored in the European Union.”
A transfer disclosure. “All personal information processed by us may be transferred, processed, and stored anywhere in the world, including … the United States or other countries.”
The second is the sentence most vendors publish, and it is notice that there is no promise. Someone searching a privacy policy for “United States” finds it, sees the country and the word “stored,” and answers a questionnaire from it. That is the mistake this page is for.
Neither sentence is a fault. An international transfer notice is ordinary and frequently required drafting. What separates them is what you can hold the vendor to.
What the record holds
Of 186 vendors whose pages Xither reads, 21 publish a residency commitment we could read, 35 publish only a transfer disclosure, and 130 publish neither.
That last number is the finding rather than a hole in the data. A vendor that says nothing about where your data sits has told you something, and the date we looked is on the record. A vendor whose pages refuse our reader is recorded that way too, which is not the same as publishing nothing.
Places named in a commitment
United States14 vendors
European Union7 vendors
Australia1 vendor
India1 vendor
United Kingdom1 vendor
Vendors that name a place and say data is kept there
Read the hedges. “Primarily,” “by default” and “where available” are the vendors’ own words, and each one is load-bearing. So is the scope: several of these commit for customer content while naming logs, telemetry or backups separately, or leaving them out.
Box · United States
(b) the applicable Service is provided from the United States and that for Box Zones, while the Content will be stored and may be partially processed in the Location(s), some processing and metadata storage and processing may continue to be provided from the United States;
https://www.box.com/legal/termsofservice · read Sep 11, 2026
DataRobot · European Union
A separate instance of DataRobot Managed AI Cloud is hosted in the AWS EU (Ireland) region to support the unique data protection requirements of EU customers.
https://datarobot.com/legal/dpa · read Sep 11, 2026
DataRobot · United States
DataRobot is Privacy Shield certified, which allows EU and Swiss personal business data to be processed in the US.
https://datarobot.com/legal/dpa · read Sep 11, 2026
ElevenLabs · European Union
When used with EU Data Residency and Zero Retention mode, the HDS (Hébergeur de Données de Santé) certification by Schellman confirms that our systems meet the highest standards of data protection and compliance under French law - marking another step forward in delivering secure, compliant AI infrastructure for our customers.
https://compliance.elevenlabs.io/ · read Sep 10, 2026
ElevenLabs · India
Azure • Cloud infrastructure, data storage & LLM Services India With respect to LLM Services, to the extent India Data Residency is selected by the customer per the terms of such customer's agreement, LLMs may be provided through Azure.
https://compliance.elevenlabs.io/subprocessors · read Sep 11, 2026
H2O.ai · United States
Personal data is primarily processed in the U.S., but customers can select data residency options where available.
https://h2o.ai/privacy · read Aug 31, 2026
HubSpot · European Union
As of July 19, 2021, new HubSpot customers have the option to store their data in our EU data center located in Frankfurt, Germany.
https://hubspot.com/security · read Aug 31, 2026
Hugging Face · United States
LOCATION OF PROCESSING AND DATA TRANSFERS The Company and its servers are located in the United States.
https://huggingface.co/privacy · read Aug 31, 2026
Intercom · European Union
However, for those customers who use Intercom’s regional data hosting services in the EU or Australia , their data will be stored and processed in the applicable designated region (i.e., EU or Australia), unless otherwise noted in our Subprocessor Page.
https://intercom.com/data-processing-agreement · read Sep 13, 2026
Intercom · United States
Transfers of Your Personal Data 6.1The Intercom Services and Sites, and our messenger domains are provided and hosted in the United States.
https://intercom.com/privacy · read Sep 13, 2026
LiveKit · United States
Observability Data, telemetry, and related logs are stored and processed in the United States or Europe, as determined by the data region selected for Customer's project, and not by the Pinned Region;
https://livekit.io/legal/data-processing-addendum · read Sep 13, 2026
Luminance · United Kingdom
WHERE IS YOUR PERSONAL DATA STORED? Your personal data is securely stored by Luminance on the Luminance servers located in Cambridge, United Kingdom.
https://luminance.com/privacy · read Sep 13, 2026
n8n · European Union
The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union.
https://n8n.io/security · read Sep 13, 2026
Nebius · European Union
Overseas Personal Data Transfers We store your personal data in our data centres in the European Union and Israel.
https://nebius.com/privacy-policy · read Sep 13, 2026
New Relic · United States
Data Regions.** New Relic’s data hosting regions are described in the Documentation, currently located in the U.S. and the EU.
https://newrelic.com/termsandconditions/dataprotection · read Sep 12, 2026
Qdrant · United States
Enriched and attributed data is stored and further processed in our CRM system, Salesforce, Inc. ("Salesforce"), Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA, which also acts as a data processor on our behalf (see also section 1.11, Salesforce, for the general CRM use).
https://qdrant.tech/legal/privacy-policy · read Sep 13, 2026
Rev · United States
You acknowledge and agree that any personal data provided to us may be stored in or accessed from multiple countries, including the United States.
https://rev.com/legal/privacy · read Sep 13, 2026
SeekOut · United States
Where is SeekOut data hosted? SeekOut's infrastructure is hosted on enterprise-grade cloud platforms with SOC 2 certified data centers in the United States.
https://seekout.com/security · read Sep 13, 2026
Smartsheet · Australia
Customer Content submitted to AI features within Smartsheet Regions is processed within the applicable region (e.g., for Smartsheet Regions Australia, AI processing occurs within Australia).
https://smartsheet.com/legal/subprocessors · read Sep 13, 2026
Spellbook · United States
Where is customer data stored and processed? Spellbook uses cloud providers with data centers in Canada and US for storing and processing customer data.
https://spellbook.legal/security · read Sep 7, 2026
Ultralytics · United States
Multi-region infrastructure: EU, US and APAC residency regions for dataset and model content data
https://ultralytics.com/security · read Sep 13, 2026
V7 · European Union
V7 Darwin stores any of your data which reaches us in AWS S3 servers located in Ireland (EU).
https://v7labs.com/terms · read Sep 13, 2026
Wiz · United States
Additional Customer Data Restrictions.** Customer shall not provide any classified data to Wiz, and Wiz services or products hosted in the *Wiz for U.S. Government *environment may not be used to process or store classified data.
https://wiz.io/data-processing-agreement · read Sep 13, 2026
Workato · United States
The processing of outbound emails sent through and by the Workato Platform in the EU United States (for SparkPost in all regions other than EU) European Union (for SparkPost EU) https://messagebird.com Workato Sub-Processors v2026-01-21 2 Data Center will be under SparkPost EU.
https://assets.ctfassets.net/khy5qy7zbpmq/6G0KNPqb4qza8MdzdCUGQA/b8c24f5f76ade628fc86271c3d61c46b/Workato_Sub-Processors_2026-01-21.pdf · read Sep 13, 2026
Vendors that name a place inside a transfer notice
These say where data may go, which is not where it stays. They are reproduced so they can be told apart from the list above — not to fault the vendors publishing them.
Abnormal Security · United States
In particular, we may transfer your personal information to the United States and other countries where our affiliates, business partners, and service providers are located.
https://abnormalsecurity.com/privacy · read Sep 7, 2026
Algolia · European Union
We may transfer the personal data of EU residents to a country outside of the EU and the UK.
https://algolia.com/policies/privacy · read Sep 11, 2026
Anthropic · United States
Any information we hold about you will be transferred to, used, processed, and stored in the United States and other countries and territories, which may not have data privacy or data protection laws equivalent to those in your country or territory.
https://anthropic.com/privacy · read Sep 10, 2026
Anyscale · United Kingdom
(ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to section 17A of the Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protect…
https://anyscale.com/dpa · read Sep 13, 2026
Anyscale · United States
INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION All personal information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live.
https://anyscale.com/privacy · read Sep 13, 2026
Arthur AI · United States
Our affiliates’ use of your personal information will be in accordance with the terms of this Privacy Policy. *International Transfers.* Arthur is a U.S. company and the information we collect will be transferred to, stored and processed in the U.S., as well as other international locations where we have affiliates and service providers. **The U.S. and other jurisdictions to where we transfer…
https://arthur.ai/privacy · read Aug 31, 2026
Automation Anywhere · United States
Territories and Transfers Personal information collected by Automation Anywhere may be stored and processed in your geographic region, in the United States, or in other countries in which Automation Anywhere or its service providers maintain facilities or operations.
https://automationanywhere.com/privacy · read Sep 13, 2026
Beamery · United States
Where do we process your personal data? Your Personal Data may be collected, transferred to and stored by us in the United Kingdom ("UK"), European Economic Area ("EEA"), and the United States of America ("USA") or Australia.
https://beamery.com/privacy · read Sep 7, 2026
Braintrust · European Union
(a) The parties agree that Company may transfer Personal Data processed under this DPA outside the EEA, the UK, or Switzerland as necessary to provide the Services.
https://braintrust.dev/legal/dpa · read Sep 7, 2026
Braze · United States
INTERNATIONAL TRANSFERS, SECURITY AND DATA RETENTION 3.1 PROCESSING OF PERSONAL DATA IN THE U.S. AND ELSEWHERE Braze, Inc. is located in the United States ("U.S.") and our group companies operate in Brazil, Canada, France, Germany, Ireland, Romania, Spain, the United Kingdom (“UK”**), Australia, Indonesia, Japan, Singapore, South Korea, and the United Arab Emirates.
https://braze.com/privacy · read Sep 7, 2026
Camunda · United States
This may include the transfer of Personal Data to the United States and/or other countries, in particular as Camunda, for the purposes of delivering the Exams, uses the Exam Platform, which is hosted by a third party provider (pValue, Inc. doing business as Certiverse, a Delaware corporation with its principal place of business in Chicago, Illinois).
https://camunda.com/terms · read Aug 31, 2026
Clari · European Union
The parties agree that Salesloft and its Sub-Processors may make international transfers of Personal Data Processed under this DPA, including outside the EEA, the UK, or Switzerland as necessary to provide the Services, and in accordance with Data Protection Laws.
https://clari.com/dpa · read Sep 9, 2026
Darktrace · European Union
When you give us personal data, that data may be used, processed or stored anywhere in the world, including countries outside the European Economic Area (“EEA”).
https://darktrace.com/legal/privacy-policy · read Aug 31, 2026
Datadog · United States
As a result, your personal data may be transferred to, and processed in, any country where we operate or where our service providers operate, including the United States.
https://datadoghq.com/privacy · read Sep 13, 2026
Deep Instinct · United States
We may transfer or disclose Personal Information to our subsidiaries, affiliated companies, Partners or other trusted third-party service providers or contractors, located in different Data Regions across the world (i.e., Israel, Japan, and the United States) for the purpose(s) described in this Policy.
https://deepinstinct.com/privacy · read Sep 13, 2026
Domino Data Lab · United States
International Transfer of Information Collected** Services that are hosted in the United States are intended for Visitors located within the United States.
https://domino.ai/privacy-policy · read Sep 11, 2026
Freshworks · European Union
Data that Freshworks processes for Customer as a Processor may be stored in the EU or outside of the EU, depending on the Freshworks product.
https://www.freshworks.com/data-processing-addendum/ · read Sep 12, 2026
Gong · United States
To the extent Personal Data from the EEA, Switzerland or the UK is transferred to and processed by Gong in the USA on the basis of Gong’s certification to the DPF, and the Parties can no longer rely on the DPF, Section 6.3 of this DPA shall apply. **6.3.
https://gong.io/legal/data-processing-addendum · read Aug 31, 2026
Hive · United States
Information may be processed and stored in the United States or other countries.
https://thehive.ai/privacy · read Aug 31, 2026
HubSpot · United States
DATA TRANSFERS You acknowledge and agree that we may access and Process Customer Personal Data on a global basis as necessary to provide the Subscription Service in accordance with the Agreement, and in particular that Customer Personal Data may be transferred to and Processed by HubSpot, Inc. in the United States and to other jurisdictions where HubSpot Affiliates and Sub-Processors have operati…
https://legal.hubspot.com/dpa · read Sep 12, 2026
Intercom · United Kingdom
(ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to Section 17A of the Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protect…
https://intercom.com/data-processing-agreement · read Sep 13, 2026
Labelbox · United States
Specifically, we may transfer the personal information you provide to the United States and other countries where our affiliates, business partners, and service providers are located.
https://docs.labelbox.com/page/privacy-notice · read Aug 31, 2026
LiveKit · United Kingdom
To the extent Customer's use of the Services requires an onward transfer mechanism to lawfully transfer Personal Data from a jurisdiction (i.e., the European Economic Area*,* the United Kingdom, Switzerland, or any other jurisdiction listed in Schedule 4 (Jurisdiction Specific Terms) of this Addendum) to LiveKit located outside of that jurisdiction ("*Transfer Mechanism*"), the terms set forth in…
https://livekit.io/legal/data-processing-addendum · read Sep 13, 2026
Lucidworks · United States
Data Transfers** You acknowledge and agree that we may access and Process Personal Data on a global basis as necessary to provide the Service in accordance with the Agreement, and in particular that Personal Data may be transferred to and Processed by Lucidworks in the United States and to other jurisdictions where Lucidworks Affiliates and Subprocessors have operations.
https://lucidworks.com/legal/dpa · read Sep 11, 2026
Luminance · European Union
When you give us personal data, that data may be used, processed or stored anywhere in the world, including countries outside the European Economic Area (“EEA”).
https://luminance.com/privacy · read Sep 13, 2026
Moogsoft · United States
Where We Store Your Information** As an organization with global operations, the information that we collect from you may be transferred to, and stored at, a destination located in a jurisdiction other than the one in which the information was collected (information is frequently transferred to the United States because that is where our primary operations are located).
https://moogsoft.com/privacy · read Aug 31, 2026
Notion · United States
International data transfers All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live.
https://www.notion.com/trust/privacy-policy · read Aug 31, 2026
OpenAI · United States
OpenAI processes your Personal Data for the purposes described in this policy on servers located in various jurisdictions, including processing and storing your Personal Data in our facilities and servers in the United States, or in countries or territories where our affiliates and partners or our vendors and service providers are located.
https://openai.com/privacy · read Sep 12, 2026
Palo Alto Networks · United States
The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in to locations where we and our third-party service providers have operations, including in the United States of America.
https://paloaltonetworks.com/privacy · read Sep 13, 2026
Paperspace · United States
How we store and protect your information Storage and Processing: Your information collected through the Services may be stored and processed in the United States or any other country in which DigitalOcean or its subsidiaries, affiliates or service providers maintain facilities.
https://paperspace.com/privacy-policy · read Sep 7, 2026
Pinecone · United States
Any information that we collect (including your personal information) is stored and processed in various jurisdictions around the world (including in the United States), for the purposes detailed in this Privacy Policy.
https://pinecone.io/privacy · read Sep 10, 2026
PolyAI · United States
International transfers The personal data we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations, including in the United States.
https://poly.ai/privacy-policy · read Sep 13, 2026
Poolside · European Union
Transfers of Personal Data 9.1 The parties agree that Company may transfer Personal Data processed under this DPA outside the EEA, the UK, or Switzerland as necessary to provide the Services.
https://poolside.ai/legal/dpa · read Aug 31, 2026
Qdrant · European Union
In some cases, data may be transferred to and processed in countries outside the EU or the European Economic Area for this purpose ("Third Countries").
https://qdrant.tech/legal/privacy-policy · read Sep 13, 2026
Replit · United States
Cross-Border Data Transfers Our Services are primarily hosted in the United States and may also be hosted in locations outside of the jurisdiction in which you live.
https://replit.com/privacy · read Sep 11, 2026
Retell AI · United States
Content that you submit for AI-assisted prompt generation is processed to fulfill your request and is not retained by the connector beyond that purpose. INTERNATIONAL TRANSFER OF DATA Retell AI is based in the United States, and the personal information we collect is primarily stored and processed in the United States.
https://www.retellai.com/legal/privacy-policy · read Sep 13, 2026
Salesloft · European Union
The parties agree that Salesloft and its Sub-Processors may make international transfers of Personal Data Processed under this DPA, including outside the EEA, the UK, or Switzerland as necessary to provide the Services, and in accordance with Data Protection Laws.
https://salesloft.com/legal/data-processing-addendum · read Sep 13, 2026
Salesloft · United States
If you do not want your personal information transferred to or processed or maintained in the United States, you should not use our Websites or should not engage in Interactions with us.
https://salesloft.com/privacy-policy · read Sep 13, 2026
SAS · European Union
Therefore, your personal data may be transferred and processed outside your jurisdiction and in countries that may not provide for the same level of data protection as your jurisdiction, such as the European Economic Area (“EEA”).
https://sas.com/privacy · read Aug 31, 2026
SAS · United States
Personal information collected on our site may be transferred across state and country borders and stored or processed in the United States or any other country in which SAS or its subsidiaries, affiliates, or business units maintain facilities for the purposes of data consolidation, storage, and simplified customer information management.
https://sas.com/privacy · read Aug 31, 2026
Scale AI · United States
International Transfer Information that we collect from you may be transferred to, stored, and processed by us, our affiliates, and other third parties in countries outside the EEA, the UK, and Switzerland including, but not limited to, the United States and other countries, where data protection and privacy regulations may not offer the same level of protection as in other parts of the world.
https://scale.ai/legal/privacy · read Sep 13, 2026
Speechmatics · United Kingdom
Where we store your data As some of our hosting is provided by third party cloud providers, the data that we collect from you may be stored and processed in a location outside of the European Economic Area, United Kingdom or Switzerland.
https://speechmatics.com/privacy-policy · read Aug 31, 2026
Zapier · United States
In connection with the performance of the Agreement, you authorize Zapier to transfer Personal Information internationally, and in particular, that Personal Information may be transferred to and processed by Zapier in the United States and other jurisdictions where Zapier and its Subprocessors have operations.
https://zapier.com/dpa · read Sep 13, 2026
What to ask for
A commitment you can hold a vendor to says three things a disclosure does not: which region, which data — customer content, logs, telemetry and backups are often split — and what happens when the region is unavailable. LiveKit’s entry above names observability data separately from the pinned region — the split most agreements leave silent.
A commitment can also go stale without being withdrawn. One entry above cites the EU–US Privacy Shield, which that page still names. Whether a framework a vendor cites is currently in force is a question for your counsel; what the record gives you is the exact sentence and the day we read it, which is usually the part that is hard to get.
Where residency matters, it belongs in the agreement rather than on a trust page. A page can change without notice; a clause cannot.
Take it with you
Both lists as a Word document, with every quote, source and read date. It is generated when you download it, so it carries the record as it stands that day.
How the two lists are separated
Mechanically, and the rule is short enough to state. A sentence that names a place inside a transfer notice — “anywhere in the world,” “or other countries,” “may be transferred” — is a disclosure. A sentence saying data is kept somewhere with no escape clause attached is a commitment. A sentence we cannot read as either is left out rather than filed under a heading it does not fit.
Nothing here is summarized, scored or ranked, and no model decides what a page means. How the record is kept.
Common questions
- What is data residency?
- A commitment by a vendor that your data is stored, and usually processed, inside a named place. It is a property of the service the vendor sells, and a vendor that offers it normally says which region, and often charges for the choice.
- What is the difference between data residency and an international transfer clause?
- A residency commitment names a place and promises it. An international transfer clause names a place inside a list of everywhere data might go — “anywhere in the world,” “or other countries.” Both sentences contain a country name and the word “stored,” which is why they are so easily confused, but only the first is a promise.
- Does a US-headquartered vendor process my data in the US?
- Its privacy policy almost certainly says data may be transferred to and processed in the United States, because nearly every US company publishes that notice. That sentence is not a statement about where your data actually sits, and it is not a commitment you can hold the vendor to.
- Which AI vendors offer EU data residency?
- From the pages we read, the vendors publishing an EU residency commitment we could quote are listed on this page with their exact wording. The list is what the record holds, not a survey of the market — a vendor absent from it may offer residency and not publish the fact where we look.
- Does data residency mean my data never leaves the region?
- Not necessarily, and the difference is usually in which data. Several commitments cover customer content while naming logs, telemetry or backups separately, or not at all. The wording quoted here is the vendor's own, hedges included.
Security questionnaires
Answer what a customer's security team asks about your AI stack.
- Answering “list every AI sub-processor”
What the question is asking for, where each vendor publishes the answer, and what to say about the gaps.
- Which certifications AI vendors say they hold
SOC 2, ISO 27001, ISO 42001 and more, counted off trust pages and kept apart by level — says, not holds.
- Which AI vendors say they will not train on your data
Commitments not to train, and opt-outs, quoted from vendor pages — with no list of vendors that do, because that list cannot be read honestly.
- How long AI vendors keep your data
Every retention window we can quote, grouped by vendor — because a vendor states several, and they cover different data.
- Answering the AI questions in a security questionnaire
Eight questions, the answer that closes and the boundary on each — starting with the fact that “list every AI sub-processor” means about ninety companies.
- AI supply-chain question set
29 questions to put to an AI vendor — drafted by a language model, reviewed by a second, and published with all 15 edits shown.
This is not legal advice. The pages quoted are published documents read on the dates shown; your negotiated contract governs over anything here. The record behind this page is free to read, and corrections are free to request.