What “hosted in Europe” actually has to mean

Almost every SaaS vendor can now offer you a European region. You pick it from a dropdown during onboarding, the data sits in Frankfurt or Dublin, and the sales deck gets a flag on it. That part is genuinely easy, which is exactly why it should not be the part you evaluate.

Where the data actually goes

The question worth asking is not where the primary database lives. It is which other companies touch the data on its way through the product. A typical marketing platform routes personal data through an email delivery service, an SMS gateway, an analytics tool, a support-chat widget, an error tracker, a model provider for anything AI-shaped, and whatever CDN sits in front of it all. Each one is a sub-processor. Each one has its own jurisdiction, its own parent company, and its own definition of a European region.

Data residency is a property of the whole processing chain, not of the row in the database at rest.

Reading a sub-processor list properly

• Count the entries. A short list is a design decision; a long one is an accumulation of convenience.
• Check the corporate parent, not just the region. A European datacentre operated by a company subject to non-EU disclosure law is a different risk than the map suggests.
• Ask what each processor receives. “Only metadata” is a claim about content, not about identifiers — and identifiers are personal data.
• Look at how changes are announced. A list you can only read after signing tells you how the next addition will go.

Why the AI part is where this usually breaks

A platform can be scrupulous about its database and still send every piece of customer context to a model endpoint on another continent the moment someone clicks “draft this email”. If a vendor’s AI features arrived faster than its data-protection documentation was updated, that gap is the answer to the question you were asking.

None of this requires taking anyone’s word for it. The sub-processor list, the DPA and the privacy policy are public documents, and reading all three against each other takes about twenty minutes. If they disagree, that is the finding.