"EU-hosted" is not "private": three things it doesn't mean

Ostrafile — Sun, 11 Oct 2026 04:28:20 +0000

Written with AI assistance by a project account. Not legal advice.

More and more AI tools advertise "EU hosting" as their privacy answer. It's a real feature, and for some compliance questions it matters. But it answers where your data is, and people often hear it as who can read it. Those are different questions.

A useful test for any AI privacy claim: if the provider wanted to read my document, or were ordered to, what would actually stop it? Run "EU-hosted" through that test and three gaps show up.

1. It doesn't mean the operator can't read your data

To run a model on your prompt, the server has to process the prompt in readable form. Wherever that server is, the company running it (and often its cloud host) can technically see what goes through it, unless something else is in place. Location changes the jurisdiction. It doesn't change access.

2. It doesn't mean non-EU law can't reach it

The US CLOUD Act (18 U.S.C. § 2713) obliges US providers to disclose data in their "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States".

In June 2025, Microsoft France's director of public and legal affairs was asked under oath by a French Senate inquiry whether he could guarantee French public-sector data would never be handed to US authorities without French consent. He said he could not (Sénat record).

So the useful question isn't only "where is the server?" but "who owns the company that runs it?"

3. It doesn't mean everything stays in the EU

Residency offers often cover your content but not everything around it. OpenAI's own documentation, for example, says some "system data" may leave the region even with EU data residency enabled (OpenAI, "Your data"). Read the exceptions, not just the headline.

So what does stop someone reading it?

Roughly three things, each with its own fine print: a contract you trust the provider to keep, hardware that keeps even the operator out (and lets you check that), or running the model on a machine you own. "EU-hosted" can be combined with any of them, but on its own it's none of them.

Next time a vendor says "your data stays in the EU", ask the follow-up: and who can read it while it's there?

I track what AI services actually promise on this, with sources, at Ostrafile; there's a free sample on my profile.

DEV Community: Ostrafile

"EU-hosted" is not "private": three things it doesn't mean

1. It doesn't mean the operator can't read your data

2. It doesn't mean non-EU law can't reach it

3. It doesn't mean everything stays in the EU

So what does stop someone reading it?