08/10/2026
Data Residency
Data residency is the geographic location where an organization's data is physically stored, often under a contract or regulatory requirement. It describes where data sits, not where it is processed or who can access it from another country.
What a Data Residency Claim Covers
A residency claim should name the data, service, and storage region it covers. Primary databases may stay in one region while backups, logs, analytics records, or attachments follow different rules, so a country name alone isn't enough to assess the full data path.
Residency also answers a different question from zero data retention, which asks whether covered data remains after processing. Grounding controls which sources support an AI answer, but it doesn't control where those sources or conversation records are stored.
How to Test a Data Residency Claim
A buyer can test the claim with three questions that force a vendor to describe the full operating path:
- Where is data stored? Include primary copies, backups, logs, prompts, uploaded files, and deletion records.
- Where is data processed? Check model inference, indexing, analytics, monitoring, and each subprocessor.
- Who can access it, and from where? Include vendor employees, support teams, contractors, and subprocessors by country.
Each answer should point to a contract, data processing agreement, subprocessor list, or service document and name any exceptions. Wonderchat publishes the method behind the number. Teams comparing private AI tools for regulated industries can apply the same three questions to every shortlisted vendor.
Why EU Storage Isn't a Privacy Guarantee
EU storage doesn't guarantee full GDPR compliance on its own. The European Commission's transfer guidance explains that personal data may move outside the European Economic Area when an approved transfer mechanism or safeguard applies.
Access can also matter without moving the stored copy. Under the EDPB's international transfer test, making data available to a separate controller or processor in another country can be a transfer. An employee of the same controller working abroad is treated differently, so the parties and roles must be checked before drawing a legal conclusion.
Microsoft Azure is a useful benchmark when regional control matters because its data residency documentation separates regional storage commitments from service exceptions and global processing choices. That detail is more useful than a broad claim that data stays in a named geography.
Frequently Asked Questions
Is data residency the same as data sovereignty?
No. Data residency describes the physical storage location. Data sovereignty concerns the laws and government powers that apply to data, which may depend on location, the provider, the customer, and the parties allowed to access it.
Does GDPR require EU data residency?
No. GDPR doesn't impose a blanket rule that personal data must remain in the EU. Transfers outside the EEA may be permitted through an adequacy decision, appropriate safeguards, or another valid mechanism, although contracts or sector rules may add location requirements.
Does residency cover vendor support access?
Not by itself. A residency statement may identify the storage region without naming where support staff or subprocessors work. Buyers should request the access countries, legal roles, purposes, controls, and transfer mechanism separately.
