Data residency covers more than the main database. Backups, logs, the AI models that read the data, and each outside service involved can all sit in different places. “Stored in the EU” and “processed only in the EU” are different claims, and both are different from “never leaves the EU”.
Why it matters
The GDPR does not forbid data leaving the EU, but it requires safeguards such as Standard Contractual Clauses when it does. Some customers go further and want everything in the EU. The honest answer to “where is my data?” is usually a list: where each kind of data lives, and why.
When a vendor says “EU hosting”, ask which parts that covers.
An example
A tool stores emails in Frankfurt but sends each one to an AI model in the United States to draft the reply. Storage is in the EU; one processing step is not.
In ReplyPen: Threads and Drafts are stored in AWS Frankfurt. Not every step runs in the EU today: one of the two AI providers processes in the United States under Standard Contractual Clauses, and what ReplyPen learns about your business is kept in a repository in the United States. The full list is on where your data goes.