Resource · Security questionnaires

Where AI vendors say they keep your data

Two kinds of sentence answer that question and they look almost identical. One promises a place. The other names a place inside a list of everywhere else. Both are quoted below, kept apart, with the page each came from and the date we read it.

Both sentences name a country. Only one is a promise.

A commitment. “Airtable offers our customers the option to have their data stored in the European Union.”

A transfer disclosure. “All personal information processed by us may be transferred, processed, and stored anywhere in the world, including … the United States or other countries.”

The second is the sentence most vendors publish, and it is notice that there is no promise. Someone searching a privacy policy for “United States” finds it, sees the country and the word “stored,” and answers a questionnaire from it. That is the mistake this page is for.

Neither sentence is a fault. An international transfer notice is ordinary and frequently required drafting. What separates them is what you can hold the vendor to.

What the record holds

Of 186 vendors whose pages Xither reads, 21 publish a residency commitment we could read, 35 publish only a transfer disclosure, and 130 publish neither.

That last number is the finding rather than a hole in the data. A vendor that says nothing about where your data sits has told you something, and the date we looked is on the record. A vendor whose pages refuse our reader is recorded that way too, which is not the same as publishing nothing.

Places named in a commitment

United States14 vendors

European Union7 vendors

Australia1 vendor

India1 vendor

United Kingdom1 vendor

Vendors that name a place and say data is kept there

Read the hedges. “Primarily,” “by default” and “where available” are the vendors’ own words, and each one is load-bearing. So is the scope: several of these commit for customer content while naming logs, telemetry or backups separately, or leaving them out.

Box · United States

(b) the applicable Service is provided from the United States and that for Box Zones, while the Content will be stored and may be partially processed in the Location(s), some processing and metadata storage and processing may continue to be provided from the United States;

https://www.box.com/legal/termsofservice · read Sep 11, 2026

DataRobot · European Union

A separate instance of DataRobot Managed AI Cloud is hosted in the AWS EU (Ireland) region to support the unique data protection requirements of EU customers.

https://datarobot.com/legal/dpa · read Sep 11, 2026

DataRobot · United States

DataRobot is Privacy Shield certified, which allows EU and Swiss personal business data to be processed in the US.

https://datarobot.com/legal/dpa · read Sep 11, 2026

ElevenLabs · European Union

When used with EU Data Residency and Zero Retention mode, the HDS (Hébergeur de Données de Santé) certification by Schellman confirms that our systems meet the highest standards of data protection and compliance under French law - marking another step forward in delivering secure, compliant AI infrastructure for our customers.

https://compliance.elevenlabs.io/ · read Sep 10, 2026

ElevenLabs · India

Azure • Cloud infrastructure, data storage & LLM Services India With respect to LLM Services, to the extent India Data Residency is selected by the customer per the terms of such customer's agreement, LLMs may be provided through Azure.

https://compliance.elevenlabs.io/subprocessors · read Sep 11, 2026

H2O.ai · United States

Personal data is primarily processed in the U.S., but customers can select data residency options where available.

https://h2o.ai/privacy · read Aug 31, 2026

HubSpot · European Union

As of July 19, 2021, new HubSpot customers have the option to store their data in our EU data center located in Frankfurt, Germany.

https://hubspot.com/security · read Aug 31, 2026

Hugging Face · United States

LOCATION OF PROCESSING AND DATA TRANSFERS The Company and its servers are located in the United States.

https://huggingface.co/privacy · read Aug 31, 2026

Intercom · European Union

However, for those customers who use Intercom’s regional data hosting services in the EU or Australia , their data will be stored and processed in the applicable designated region (i.e., EU or Australia), unless otherwise noted in our Subprocessor Page.

https://intercom.com/data-processing-agreement · read Sep 13, 2026

Intercom · United States

Transfers of Your Personal Data 6.1The Intercom Services and Sites, and our messenger domains are provided and hosted in the United States.

https://intercom.com/privacy · read Sep 13, 2026

LiveKit · United States

Observability Data, telemetry, and related logs are stored and processed in the United States or Europe, as determined by the data region selected for Customer's project, and not by the Pinned Region;

https://livekit.io/legal/data-processing-addendum · read Sep 13, 2026

Luminance · United Kingdom

WHERE IS YOUR PERSONAL DATA STORED? Your personal data is securely stored by Luminance on the Luminance servers located in Cambridge, United Kingdom.

https://luminance.com/privacy · read Sep 13, 2026

n8n · European Union

The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union.

https://n8n.io/security · read Sep 13, 2026

Nebius · European Union

Overseas Personal Data Transfers We store your personal data in our data centres in the European Union and Israel.

https://nebius.com/privacy-policy · read Sep 13, 2026

New Relic · United States

Data Regions.** New Relic’s data hosting regions are described in the Documentation, currently located in the U.S. and the EU.

https://newrelic.com/termsandconditions/dataprotection · read Sep 12, 2026

Qdrant · United States

Enriched and attributed data is stored and further processed in our CRM system, Salesforce, Inc. ("Salesforce"), Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA, which also acts as a data processor on our behalf (see also section 1.11, Salesforce, for the general CRM use).

https://qdrant.tech/legal/privacy-policy · read Sep 13, 2026

Rev · United States

You acknowledge and agree that any personal data provided to us may be stored in or accessed from multiple countries, including the United States.

https://rev.com/legal/privacy · read Sep 13, 2026

SeekOut · United States

Where is SeekOut data hosted? SeekOut's infrastructure is hosted on enterprise-grade cloud platforms with SOC 2 certified data centers in the United States.

https://seekout.com/security · read Sep 13, 2026

Smartsheet · Australia

Customer Content submitted to AI features within Smartsheet Regions is processed within the applicable region (e.g., for Smartsheet Regions Australia, AI processing occurs within Australia).

https://smartsheet.com/legal/subprocessors · read Sep 13, 2026

Spellbook · United States

Where is customer data stored and processed? Spellbook uses cloud providers with data centers in Canada and US for storing and processing customer data.

https://spellbook.legal/security · read Sep 7, 2026

Ultralytics · United States

Multi-region infrastructure: EU, US and APAC residency regions for dataset and model content data

https://ultralytics.com/security · read Sep 13, 2026

V7 · European Union

V7 Darwin stores any of your data which reaches us in AWS S3 servers located in Ireland (EU).

https://v7labs.com/terms · read Sep 13, 2026

Wiz · United States

Additional Customer Data Restrictions.** Customer shall not provide any classified data to Wiz, and Wiz services or products hosted in the *Wiz for U.S. Government *environment may not be used to process or store classified data.

https://wiz.io/data-processing-agreement · read Sep 13, 2026

Workato · United States

The processing of outbound emails sent through and by the Workato Platform in the EU United States (for SparkPost in all regions other than EU) European Union (for SparkPost EU) https://messagebird.com Workato Sub-Processors v2026-01-21 2 Data Center will be under SparkPost EU.

https://assets.ctfassets.net/khy5qy7zbpmq/6G0KNPqb4qza8MdzdCUGQA/b8c24f5f76ade628fc86271c3d61c46b/Workato_Sub-Processors_2026-01-21.pdf · read Sep 13, 2026

Vendors that name a place inside a transfer notice

These say where data may go, which is not where it stays. They are reproduced so they can be told apart from the list above — not to fault the vendors publishing them.

Abnormal Security · United States

In particular, we may transfer your personal information to the United States and other countries where our affiliates, business partners, and service providers are located.

https://abnormalsecurity.com/privacy · read Sep 7, 2026

Algolia · European Union

We may transfer the personal data of EU residents to a country outside of the EU and the UK.

https://algolia.com/policies/privacy · read Sep 11, 2026

Anthropic · United States

Any information we hold about you will be transferred to, used, processed, and stored in the United States and other countries and territories, which may not have data privacy or data protection laws equivalent to those in your country or territory.

https://anthropic.com/privacy · read Sep 10, 2026

Anyscale · United Kingdom

(ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to section 17A of the Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protect…

https://anyscale.com/dpa · read Sep 13, 2026

Anyscale · United States

INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION All personal information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live.

https://anyscale.com/privacy · read Sep 13, 2026

Arthur AI · United States

Our affiliates’ use of your personal information will be in accordance with the terms of this Privacy Policy. *International Transfers.* Arthur is a U.S. company and the information we collect will be transferred to, stored and processed in the U.S., as well as other international locations where we have affiliates and service providers. **The U.S. and other jurisdictions to where we transfer…

https://arthur.ai/privacy · read Aug 31, 2026

Automation Anywhere · United States

Territories and Transfers Personal information collected by Automation Anywhere may be stored and processed in your geographic region, in the United States, or in other countries in which Automation Anywhere or its service providers maintain facilities or operations.

https://automationanywhere.com/privacy · read Sep 13, 2026

Beamery · United States

Where do we process your personal data? Your Personal Data may be collected, transferred to and stored by us in the United Kingdom ("UK"), European Economic Area ("EEA"), and the United States of America ("USA") or Australia.

https://beamery.com/privacy · read Sep 7, 2026

Braintrust · European Union

(a) The parties agree that Company may transfer Personal Data processed under this DPA outside the EEA, the UK, or Switzerland as necessary to provide the Services.

https://braintrust.dev/legal/dpa · read Sep 7, 2026

Braze · United States

INTERNATIONAL TRANSFERS, SECURITY AND DATA RETENTION 3.1 PROCESSING OF PERSONAL DATA IN THE U.S. AND ELSEWHERE Braze, Inc. is located in the United States ("U.S.") and our group companies operate in Brazil, Canada, France, Germany, Ireland, Romania, Spain, the United Kingdom (“UK”**), Australia, Indonesia, Japan, Singapore, South Korea, and the United Arab Emirates.

https://braze.com/privacy · read Sep 7, 2026

Camunda · United States

This may include the transfer of Personal Data to the United States and/or other countries, in particular as Camunda, for the purposes of delivering the Exams, uses the Exam Platform, which is hosted by a third party provider (pValue, Inc. doing business as Certiverse, a Delaware corporation with its principal place of business in Chicago, Illinois).

https://camunda.com/terms · read Aug 31, 2026

Clari · European Union

The parties agree that Salesloft and its Sub-Processors may make international transfers of Personal Data Processed under this DPA, including outside the EEA, the UK, or Switzerland as necessary to provide the Services, and in accordance with Data Protection Laws.

https://clari.com/dpa · read Sep 9, 2026

Darktrace · European Union

When you give us personal data, that data may be used, processed or stored anywhere in the world, including countries outside the European Economic Area (“EEA”).

https://darktrace.com/legal/privacy-policy · read Aug 31, 2026

Datadog · United States

As a result, your personal data may be transferred to, and processed in, any country where we operate or where our service providers operate, including the United States.

https://datadoghq.com/privacy · read Sep 13, 2026

Deep Instinct · United States

We may transfer or disclose Personal Information to our subsidiaries, affiliated companies, Partners or other trusted third-party service providers or contractors, located in different Data Regions across the world (i.e., Israel, Japan, and the United States) for the purpose(s) described in this Policy.

https://deepinstinct.com/privacy · read Sep 13, 2026

Domino Data Lab · United States

International Transfer of Information Collected** Services that are hosted in the United States are intended for Visitors located within the United States.

https://domino.ai/privacy-policy · read Sep 11, 2026

Freshworks · European Union

Data that Freshworks processes for Customer as a Processor may be stored in the EU or outside of the EU, depending on the Freshworks product.

https://www.freshworks.com/data-processing-addendum/ · read Sep 12, 2026

Gong · United States

To the extent Personal Data from the EEA, Switzerland or the UK is transferred to and processed by Gong in the USA on the basis of Gong’s certification to the DPF, and the Parties can no longer rely on the DPF, Section ‎6.3 of this DPA shall apply. **6.3.

https://gong.io/legal/data-processing-addendum · read Aug 31, 2026

Hive · United States

Information may be processed and stored in the United States or other countries.

https://thehive.ai/privacy · read Aug 31, 2026

HubSpot · United States

DATA TRANSFERS You acknowledge and agree that we may access and Process Customer Personal Data on a global basis as necessary to provide the Subscription Service in accordance with the Agreement, and in particular that Customer Personal Data may be transferred to and Processed by HubSpot, Inc. in the United States and to other jurisdictions where HubSpot Affiliates and Sub-Processors have operati…

https://legal.hubspot.com/dpa · read Sep 12, 2026

Intercom · United Kingdom

(ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to Section 17A of the Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protect…

https://intercom.com/data-processing-agreement · read Sep 13, 2026

Labelbox · United States

Specifically, we may transfer the personal information you provide to the United States and other countries where our affiliates, business partners, and service providers are located.

https://docs.labelbox.com/page/privacy-notice · read Aug 31, 2026

LiveKit · United Kingdom

To the extent Customer's use of the Services requires an onward transfer mechanism to lawfully transfer Personal Data from a jurisdiction (i.e., the European Economic Area*,* the United Kingdom, Switzerland, or any other jurisdiction listed in Schedule 4 (Jurisdiction Specific Terms) of this Addendum) to LiveKit located outside of that jurisdiction ("*Transfer Mechanism*"), the terms set forth in…

https://livekit.io/legal/data-processing-addendum · read Sep 13, 2026

Lucidworks · United States

Data Transfers** You acknowledge and agree that we may access and Process Personal Data on a global basis as necessary to provide the Service in accordance with the Agreement, and in particular that Personal Data may be transferred to and Processed by Lucidworks in the United States and to other jurisdictions where Lucidworks Affiliates and Subprocessors have operations.

https://lucidworks.com/legal/dpa · read Sep 11, 2026

Luminance · European Union

When you give us personal data, that data may be used, processed or stored anywhere in the world, including countries outside the European Economic Area (“EEA”).

https://luminance.com/privacy · read Sep 13, 2026

Moogsoft · United States

Where We Store Your Information** As an organization with global operations, the information that we collect from you may be transferred to, and stored at, a destination located in a jurisdiction other than the one in which the information was collected (information is frequently transferred to the United States because that is where our primary operations are located).

https://moogsoft.com/privacy · read Aug 31, 2026

Notion · United States

International data transfers All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live.

https://www.notion.com/trust/privacy-policy · read Aug 31, 2026

OpenAI · United States

OpenAI processes your Personal Data for the purposes described in this policy on servers located in various jurisdictions, including processing and storing your Personal Data in our facilities and servers in the United States, or in countries or territories where our affiliates and partners or our vendors and service providers are located.

https://openai.com/privacy · read Sep 12, 2026

Palo Alto Networks · United States

The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in to locations where we and our third-party service providers have operations, including in the United States of America.

https://paloaltonetworks.com/privacy · read Sep 13, 2026

Paperspace · United States

How we store and protect your information Storage and Processing: Your information collected through the Services may be stored and processed in the United States or any other country in which DigitalOcean or its subsidiaries, affiliates or service providers maintain facilities.

https://paperspace.com/privacy-policy · read Sep 7, 2026

Pinecone · United States

Any information that we collect (including your personal information) is stored and processed in various jurisdictions around the world (including in the United States), for the purposes detailed in this Privacy Policy.

https://pinecone.io/privacy · read Sep 10, 2026

PolyAI · United States

International transfers The personal data we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third-party service providers have operations, including in the United States.

https://poly.ai/privacy-policy · read Sep 13, 2026

Poolside · European Union

Transfers of Personal Data 9.1 The parties agree that Company may transfer Personal Data processed under this DPA outside the EEA, the UK, or Switzerland as necessary to provide the Services.

https://poolside.ai/legal/dpa · read Aug 31, 2026

Qdrant · European Union

In some cases, data may be transferred to and processed in countries outside the EU or the European Economic Area for this purpose ("Third Countries").

https://qdrant.tech/legal/privacy-policy · read Sep 13, 2026

Replit · United States

Cross-Border Data Transfers Our Services are primarily hosted in the United States and may also be hosted in locations outside of the jurisdiction in which you live.

https://replit.com/privacy · read Sep 11, 2026

Retell AI · United States

Content that you submit for AI-assisted prompt generation is processed to fulfill your request and is not retained by the connector beyond that purpose. ‍ INTERNATIONAL TRANSFER OF DATA Retell AI is based in the United States, and the personal information we collect is primarily stored and processed in the United States.

https://www.retellai.com/legal/privacy-policy · read Sep 13, 2026

Salesloft · European Union

The parties agree that Salesloft and its Sub-Processors may make international transfers of Personal Data Processed under this DPA, including outside the EEA, the UK, or Switzerland as necessary to provide the Services, and in accordance with Data Protection Laws.

https://salesloft.com/legal/data-processing-addendum · read Sep 13, 2026

Salesloft · United States

If you do not want your personal information transferred to or processed or maintained in the United States, you should not use our Websites or should not engage in Interactions with us.

https://salesloft.com/privacy-policy · read Sep 13, 2026

SAS · European Union

Therefore, your personal data may be transferred and processed outside your jurisdiction and in countries that may not provide for the same level of data protection as your jurisdiction, such as the European Economic Area (“EEA”).

https://sas.com/privacy · read Aug 31, 2026

SAS · United States

Personal information collected on our site may be transferred across state and country borders and stored or processed in the United States or any other country in which SAS or its subsidiaries, affiliates, or business units maintain facilities for the purposes of data consolidation, storage, and simplified customer information management.

https://sas.com/privacy · read Aug 31, 2026

Scale AI · United States

International Transfer Information that we collect from you may be transferred to, stored, and processed by us, our affiliates, and other third parties in countries outside the EEA, the UK, and Switzerland including, but not limited to, the United States and other countries, where data protection and privacy regulations may not offer the same level of protection as in other parts of the world.

https://scale.ai/legal/privacy · read Sep 13, 2026

Speechmatics · United Kingdom

Where we store your data As some of our hosting is provided by third party cloud providers, the data that we collect from you may be stored and processed in a location outside of the European Economic Area, United Kingdom or Switzerland.

https://speechmatics.com/privacy-policy · read Aug 31, 2026

Zapier · United States

In connection with the performance of the Agreement, you authorize Zapier to transfer Personal Information internationally, and in particular, that Personal Information may be transferred to and processed by Zapier in the United States and other jurisdictions where Zapier and its Subprocessors have operations.

https://zapier.com/dpa · read Sep 13, 2026

What to ask for

A commitment you can hold a vendor to says three things a disclosure does not: which region, which data — customer content, logs, telemetry and backups are often split — and what happens when the region is unavailable. LiveKit’s entry above names observability data separately from the pinned region — the split most agreements leave silent.

A commitment can also go stale without being withdrawn. One entry above cites the EU–US Privacy Shield, which that page still names. Whether a framework a vendor cites is currently in force is a question for your counsel; what the record gives you is the exact sentence and the day we read it, which is usually the part that is hard to get.

Where residency matters, it belongs in the agreement rather than on a trust page. A page can change without notice; a clause cannot.

Take it with you

Both lists as a Word document, with every quote, source and read date. It is generated when you download it, so it carries the record as it stands that day.

Get the checklist

A Word document, generated from the record when you download it. Every clause carries the page it came from and the date we read it.

How the two lists are separated

Mechanically, and the rule is short enough to state. A sentence that names a place inside a transfer notice — “anywhere in the world,” “or other countries,” “may be transferred” — is a disclosure. A sentence saying data is kept somewhere with no escape clause attached is a commitment. A sentence we cannot read as either is left out rather than filed under a heading it does not fit.

Nothing here is summarized, scored or ranked, and no model decides what a page means. How the record is kept.

Common questions

What is data residency?
A commitment by a vendor that your data is stored, and usually processed, inside a named place. It is a property of the service the vendor sells, and a vendor that offers it normally says which region, and often charges for the choice.
What is the difference between data residency and an international transfer clause?
A residency commitment names a place and promises it. An international transfer clause names a place inside a list of everywhere data might go — “anywhere in the world,” “or other countries.” Both sentences contain a country name and the word “stored,” which is why they are so easily confused, but only the first is a promise.
Does a US-headquartered vendor process my data in the US?
Its privacy policy almost certainly says data may be transferred to and processed in the United States, because nearly every US company publishes that notice. That sentence is not a statement about where your data actually sits, and it is not a commitment you can hold the vendor to.
Which AI vendors offer EU data residency?
From the pages we read, the vendors publishing an EU residency commitment we could quote are listed on this page with their exact wording. The list is what the record holds, not a survey of the market — a vendor absent from it may offer residency and not publish the fact where we look.
Does data residency mean my data never leaves the region?
Not necessarily, and the difference is usually in which data. Several commitments cover customer content while naming logs, telemetry or backups separately, or not at all. The wording quoted here is the vendor's own, hedges included.

Security questionnaires

Answer what a customer's security team asks about your AI stack.

Everything in the resources section

This is not legal advice. The pages quoted are published documents read on the dates shown; your negotiated contract governs over anything here. The record behind this page is free to read, and corrections are free to request.