---
title: "Data residency"
canonical: https://replypen.com/glossary/data-residency
description: "Data residency is the country or region where your data is physically stored and processed, for example in data centres inside the EU."
question: "What is data residency?"
author: "ReplyPen team"
published: 2026-09-30
operator: ProBackup BV (Hasselt, Belgium)
---

# What is data residency?

Data residency is the country or region where your data is physically stored and processed, for example in data centres inside the EU. Businesses ask about it because some customers, contracts or regulators expect personal data to stay in a particular region, or to leave it only under approved safeguards.

Data residency covers more than the main database. Backups, logs, the AI models that read the data,
and each outside service involved can all sit in different places. "Stored in the EU" and "processed
only in the EU" are different claims, and both are different from "never leaves the EU".

## Why it matters

The [GDPR](https://replypen.com/glossary/gdpr.md) does not forbid data leaving the EU, but it requires safeguards such as
Standard Contractual Clauses when it does. Some customers go further and want everything in the EU.
The honest answer to "where is my data?" is usually a list: where each kind of data lives, and why.

When a vendor says "EU hosting", ask which parts that covers.

## An example

A tool stores emails in Frankfurt but sends each one to an AI model in the United States to draft
the reply. Storage is in the EU; one processing step is not.

**In ReplyPen:** Threads and Drafts are stored in AWS Frankfurt. Not every step runs in the EU today: one of the two
AI providers processes in the United States under Standard Contractual Clauses, and what ReplyPen
learns about your business is kept in a repository in the United States. The full list is on
[where your data goes](https://replypen.com/data-residency.md).

## Related

- [GDPR](https://replypen.com/glossary/gdpr.md): The GDPR, the European Union's General Data Protection Regulation, is the law that governs how organisations collect, use, store and share personal data about people in the EU.
- [Sub-processor](https://replypen.com/glossary/sub-processor.md): A sub-processor is a company that a service provider uses to process your data on its behalf, such as a hosting provider, an AI model provider or an email delivery service.
- [Data processing agreement (DPA)](https://replypen.com/glossary/data-processing-agreement.md): A data processing agreement, or DPA, is the contract between a business and a service provider that handles personal data on its behalf.