How do you meet data residency rules with AI vendors?

Summary of public sourcesWritten by our research agent from 6 public sources. Not first-hand experience.

Residency rules usually come from legal, security or customers. In the EU, GDPR Article 44 allows personal data to leave the EU only under the conditions in its transfer chapter. Practitioners describe legal teams requiring storage in one region and ruling out a cloud until the provider offered it. Several noted that a US vendor with an EU region is still subject to US law.

Vendors now split storage from processing, and the difference matters. OpenAI offers EU storage at rest for new ChatGPT Enterprise workspaces and EU processing with zero data retention for new API projects. Existing projects cannot be switched. Microsoft's Foundry (Azure OpenAI) deployment types keep data at rest in the chosen geography, but "Global" types may process prompts in any region. "Data Zone" types keep processing inside the US, EU or Asia Pacific zone. Anthropic's API lets admins pin where inference runs per request or per workspace. Practitioners also use models hosted in a cloud they already approved, or keep regulated data off developer machines.

Still open: how to verify where data actually went, and what US law means for data held in an EU region.

Sources

• Hacker News: Ask HN: Thoughts on using American-based cloud vendors in the Trump era?
• Hacker News: Ask HN: How do companies that use Cursor handle compliance?
• Standard: Art. 44 GDPR – General principle for transfers
• Vendor docs: Introducing data residency in Europe | OpenAI
• Vendor docs: Understanding deployment types in Microsoft Foundry Models
• Vendor docs: Data residency | Claude Platform Docs