Nearly every AI product sold in Europe now has a flag on its homepage and a line about data residency. Very few buyers read past it, and the line is usually doing more work than it should.
Here is the thing that trips people up. "Hosted in France" and "your data stays in France" are different statements, and most AI products can only honestly make the first one.
Why the two are not the same
A typical AI SaaS product has at least two distinct data paths.
The first is storage. Your account, your documents, your conversation history, your uploaded files. This genuinely can sit on servers in one country, and for European vendors it often does.
The second is inference. When you type a question and the product generates an answer, that request goes to a language model. Very few European companies run their own models, because training and serving frontier models costs more than most of these companies have raised. So the request goes to OpenAI, Anthropic, Google, Mistral, or some combination. Several of those are American companies with American infrastructure.
Storage in Frankfurt or Paris. Inference in Virginia. Both statements true at once.
This is not a scandal, and it is not a reason to avoid these tools. It is legal, provided the transfer mechanism is right. But it does mean the flag on the homepage tells you less than you think, and the document you actually need is the one nobody puts on the homepage.
The document you want
It is called a Data Processing Agreement, or DPA. Under Article 28 of the GDPR, any vendor processing personal data on your behalf has to have one. If a vendor cannot produce one, that is your answer and you can stop there.
Inside it, go straight to the sub-processor list. This is usually an annex at the back, and it is the most honest page on any AI vendor's website. It has to name every third party that touches your data, what they do, and where they are.
Read that table and you will know more about the product's actual architecture than you will learn from the entire marketing site.
What to look for, line by line
Who the model providers are. OpenAI, Anthropic, Google, Mistral, Cohere. Their presence is normal. Their absence, on a product that clearly generates text, means the list is incomplete.
Where each one sits. United States, EU, or both. This determines what transfer safeguard is needed.
The transfer safeguard column. For US sub-processors you want Standard Contractual Clauses, adherence to the EU-US Data Privacy Framework, or both. A US sub-processor with no safeguard listed is a compliance gap.
Voice providers, if the product handles calls. Voice synthesis and transcription are frequently outsourced, and call recordings are more sensitive than most other data a small business holds.
The change notification clause. A good DPA commits to telling you when sub-processors change, and gives you a window, usually thirty days, to object.
The deletion clause. What happens at the end of the contract, in what format data comes back, how long deletion takes.
A worked example
Mirage Cloud, a French AI platform for small businesses, publishes a full sub-processor annex. Hosting is with IONOS in France. Transactional email is split between Brevo in France and Resend in the United States. Payments go through Stripe. Model inference runs through OpenAI, Anthropic and Google. Voice for the telephone agent runs through ElevenLabs in the United States. Cloudflare handles network security. Each non-EU entry lists SCCs plus Data Privacy Framework as the safeguard.
That is a normal architecture for a European AI product in 2026, and publishing it in that detail is more than many competitors do. It also demonstrates the point of this article. A buyer reading only the homepage would come away with a simpler picture than the one in the annex, and the annex is the accurate one.
Questions worth asking a vendor
Five that reliably produce useful answers.
Send me your DPA and your current sub-processor list.
Is our data used to train any model, yours or a third party's, and is that commitment written in the contract rather than only on the website?
Where is data at rest, and where does inference happen? Please answer separately.
What is your retention schedule after account deletion, broken down by category?
Have you appointed a DPO, and if not, who is the named contact for data protection questions?
That second one catches a lot of vendors out. "We do not train on your data" appears on a great many homepages and in a great many fewer contracts. If it matters to you, get it in the agreement.
None of this requires a lawyer to do a first pass. Fifteen minutes with the DPA will tell you more than an hour on the marketing site.
Top comments (0)