Does ‘EU region’ mean data stays in EU?

Not always. EU region API endpoints serve inference from EU infrastructure, but data flow can include logging, monitoring, training, sub-processor flows that route through US. Providers vary in transparency and contractual guarantees. Always verify with provider's DPA (Data Processing Agreement) in writing. For strict residency: AWS Bedrock with EU-only sub-processors, Azure OpenAI with EU residency, or Mistral (EU-headquartered) are the most reliable.

Business Associate Agreement — required under HIPAA when a healthcare entity (covered entity) shares Protected Health Information (PHI) with a third party (business associate). Without BAA, you can't legally use the AI provider for PHI processing regardless of technical security. OpenAI, Anthropic, Google Cloud, AWS, Microsoft all offer BAAs for enterprise customers. Standard API tier typically doesn't include BAA; enterprise contract required.

What's the safest residency option?

Self-hosting open-source models on your own infrastructure. Llama 3.3, DeepSeek, Mistral open-source models all available for self-hosting. Data never leaves your infrastructure; no third-party residency questions. Trade-off: higher upfront engineering cost (model serving, monitoring, scaling), capability gap (open-source quality lags top closed-frontier by 10-30%), maintenance burden. For highest-sensitivity data, worth the investment.

FedRAMP-compliant AI?

Federal Risk and Authorization Management Program — required for US federal agency cloud usage. Azure OpenAI offers FedRAMP High authorization. AWS Bedrock approaches FedRAMP via AWS GovCloud. OpenAI direct does NOT have FedRAMP; must use through Azure. For federal agency AI work, this constrains options significantly.

What about training data?

Different from inference data. Most providers explicitly state inference-time data is NOT used for training (OpenAI default since April 2023, Anthropic always opt-out, Google with appropriate API tier). Verify in DPA. For training data (when fine-tuning custom models), residency rules may differ. Always ask about data flow specifically for training pipelines if you fine-tune.

How do I verify provider claims?

Three steps: (1) Read DPA / BAA / Master Services Agreement carefully — claims should be in contractual language not just marketing. (2) Request sub-processor list. (3) For enterprise contracts, request SOC 2 Type 2 audit reports under NDA — confirms third-party audit of stated controls. Don't take marketing claims at face value; legal language matters for compliance audits.

AI & Prompt Tools · Free tool

AI Data Residency Checker

Find AI providers compliant with your region (US, EU, UK, APAC, Canada) and certifications (SOC 2, HIPAA). Includes Bedrock, Azure, Mistral, self-host.

Updated June 2026

Data residency regionNeed SOC 2 Type IINeed HIPAA BAA

Compliant providers (7)

Provider	SOC 2	HIPAA	DPA	Notes
OpenAI	&check;	&check;	Yes (DPA available)	EU data residency requires Enterprise
Anthropic	&check;	&check;	Yes	EU data residency available; Bedrock for AWS regions
Google (Gemini API)	&check;	&check;	Yes	Vertex AI offers most regions; Gemini API less granular
Mistral	&check;	−	Yes	EU-first; the default for European compliance
Cohere	&check;	&check;	Yes	Bedrock + Azure deployments cover more regions
AWS Bedrock	&check;	&check;	Yes	Most flexible regional control via AWS infrastructure
Azure OpenAI	&check;	&check;	Yes	GPT models with Azure regional control + EU Data Boundary

Always verify: compliance posture changes. Get the latest DPA + SOC 2 report directly from each vendor before signing. EU-region deployment doesn’t guarantee EU-only data flow — check the model’s own routing.

Found this useful?Email Buy Me a Coffee

What it does

Data residency requirements gate AI adoption for many enterprises and regulated industries. EU GDPR Schrems II ruling (2020) invalidated EU-US Privacy Shield, raising questions about US-hosted AI processing of EU citizen data. UK has similar concerns post-Brexit. APAC countries (Singapore, Australia, Japan) have varying data- residency rules. Healthcare (HIPAA in US, equivalent rules elsewhere), finance (SOC 2, ISO 27001, PCI DSS), and government (FedRAMP in US) require specific certifications. The checker filters AI providers by which regions they support, which certifications they hold, and which deployment options give true data residency vs theater.

Provider landscape (2024-2025): OpenAI: Enterprise plan offers EU data residency via Azure OpenAI. Standard API claims encryption-at-rest and compliance with SOC 2, but legal data flow analysis required. Anthropic: SOC 2 Type 2; offers AWS Bedrock and GCP Vertex deployment for regional residency. Google Vertex AI: most extensive regional options (EU, UK, APAC, Canada specific regions). AWS Bedrock: Anthropic, Meta, Mistral, Cohere via AWS's regional infrastructure. Azure OpenAI: enterprise-focused, EU residency, FedRAMP- approved options. Mistral: French / EU- headquartered, naturally aligned with EU residency. Cohere: SOC 2, Canadian- headquartered. Self-hosting (Llama, Mistral open-source on your infrastructure): always-compliant with any residency requirement because data never leaves your infrastructure.

Critical caveats this checker surfaces: (1) “EU region API endpoint” doesn't always guarantee EU-only data flow. Some providers route training data, logs, or backup to US even when serving inference from EU regions. Verify routing via DPAs (Data Processing Agreements) in writing. (2) Sub-processor lists matter — even compliant providers use sub-processors (CDN, monitoring, analytics) that may not be in your residency. Major providers publish sub-processor lists. (3) Logs and telemetry — many providers retain query logs for abuse-detection or model-improvement purposes; default retention may not match your residency. Negotiate zero-retention for sensitive data. (4) HIPAA covered entities require BAAs (Business Associate Agreements) — OpenAI, Anthropic, Google, Microsoft all offer for enterprise. Without BAA, you cannot use the API for PHI even if technically encrypted. (5) Self-host is the only zero-question approach for highest- sensitivity data — your infrastructure, your rules.

Embed this tool on your siteShow snippet

Paste this snippet into any page. Loads on-demand (lazy), no tracking scripts, and sized to most dashboards. Replace the height to fit your layout.

<iframe src="https://freetoolarena.com/embed/ai-data-residency-checker" width="100%" height="720" frameborder="0" loading="lazy" title="AI Data Residency Checker" style="border:1px solid #e2e8f0;border-radius:12px;max-width:720px;"></iframe>

Embed docs →

How to use it

Pick your data-residency region (US, EU, UK, APAC, Canada).
Select required certifications (SOC 2, HIPAA, ISO 27001, FedRAMP, PCI DSS).
Read filtered list of compliant providers.
Click into providers for specific deployment options (Azure, AWS Bedrock, GCP Vertex, native).
Verify routing claims with provider DPAs before production deployment.

When to use this tool

Enterprise AI procurement requiring data-residency review.
Healthcare / finance / government building AI features under regulatory constraints.
EU-headquartered companies needing GDPR-compliant AI processing.
Multi-national rollouts requiring different residency for different markets.
Self-host vs managed-API decision-making.

When not to use it

Casual / consumer use where residency doesn't legally apply.
Pre-procurement legal advice — this is informational; specific compliance needs lawyers.
Latest provider certification status — provider compliance changes; verify current status with provider.
Specific contract negotiation — DPAs and BAAs require legal team review.

Common use cases

Quick use during a typical workday
Pre-decision sanity-check on inputs and outputs
Educational use — demonstrating the underlying concept
Onboarding a colleague who needs the same calculation/conversion

Frequently asked questions

Does ‘EU region’ mean data stays in EU?: Not always. EU region API endpoints serve inference from EU infrastructure, but data flow can include logging, monitoring, training, sub-processor flows that route through US. Providers vary in transparency and contractual guarantees. Always verify with provider's DPA (Data Processing Agreement) in writing. For strict residency: AWS Bedrock with EU-only sub-processors, Azure OpenAI with EU residency, or Mistral (EU-headquartered) are the most reliable.
What's a BAA?: Business Associate Agreement — required under HIPAA when a healthcare entity (covered entity) shares Protected Health Information (PHI) with a third party (business associate). Without BAA, you can't legally use the AI provider for PHI processing regardless of technical security. OpenAI, Anthropic, Google Cloud, AWS, Microsoft all offer BAAs for enterprise customers. Standard API tier typically doesn't include BAA; enterprise contract required.
What's the safest residency option?: Self-hosting open-source models on your own infrastructure. Llama 3.3, DeepSeek, Mistral open-source models all available for self-hosting. Data never leaves your infrastructure; no third-party residency questions. Trade-off: higher upfront engineering cost (model serving, monitoring, scaling), capability gap (open-source quality lags top closed-frontier by 10-30%), maintenance burden. For highest-sensitivity data, worth the investment.
FedRAMP-compliant AI?: Federal Risk and Authorization Management Program — required for US federal agency cloud usage. Azure OpenAI offers FedRAMP High authorization. AWS Bedrock approaches FedRAMP via AWS GovCloud. OpenAI direct does NOT have FedRAMP; must use through Azure. For federal agency AI work, this constrains options significantly.
What about training data?: Different from inference data. Most providers explicitly state inference-time data is NOT used for training (OpenAI default since April 2023, Anthropic always opt-out, Google with appropriate API tier). Verify in DPA. For training data (when fine-tuning custom models), residency rules may differ. Always ask about data flow specifically for training pipelines if you fine-tune.
How do I verify provider claims?: Three steps: (1) Read DPA / BAA / Master Services Agreement carefully — claims should be in contractual language not just marketing. (2) Request sub-processor list. (3) For enterprise contracts, request SOC 2 Type 2 audit reports under NDA — confirms third-party audit of stated controls. Don't take marketing claims at face value; legal language matters for compliance audits.

See how this compares

Learn more

Explore more ai & prompt tools tools

100% in-browserNo downloadsNo sign-upMalware-freeHow we keep this safe →