AI provider location check: where does your data really sit?
Enter what you know about an AI provider: seat, parent company, data centre, sub-processors and governing law. The check shows data residency, third-country transfers and possible access under foreign law, and which questions to ask the provider.
Not legal advice · as of 13 October 2026
Data residency, transfers and access, your fact sheet.
Fill in the fields above. The assessment of data residency, transfers and access, plus the questions to ask the provider, then appear here.
Email me the result
Optional: we send you the result. Otherwise your answers only stay in your browser.
Three questions that decide the location.
Data residency
Where is your data stored and processed? A data centre in Germany or the EU keeps it within the scope of the GDPR.
Third-country transfers
If data goes to parties outside the EU, including via sub-processors, you need a basis under Chapter V GDPR.
Access under third-country law
If the provider or its parent is in a third country, authorities there may in some cases demand access, even to data in the EU.
The CLOUD Act and the Data Privacy Framework, briefly.
The US CLOUD Act of 2018 allows US authorities to demand data from US companies that the companies control, even if the data sits in a data centre in the EU. This also affects European subsidiaries whose parent is based in the USA.
The EU-US Data Privacy Framework is an adequacy decision for transfers to the USA, in force since July 2023. It only covers companies that have certified, and it governs transfers, not authorities’ access to data held in the EU.
Where to get the facts.
Imprint and contract
Seat and contracting party are in the imprint and contract. Look at the contracting entity.
DPA and list
The DPA names data centres and sub-processors. Ask for the current list.
Group structure
Check the parent company in the commercial register or annual report.
Certification
For US providers, check the US Department of Commerce’s Data Privacy Framework list.
Questions about AI provider locations.
What is data residency?
Data residency describes the country or region where data is stored and processed. For the GDPR, a data centre in the EU is an important factor. But data residency says nothing about which law the provider is subject to. That is why the check also looks at seat, parent company and sub-processors.
Does the CLOUD Act also apply to data centres in Europe?
Yes, if the provider or its parent is a US company. The CLOUD Act is tied to control over the data, not to where it is stored. Whether and how a provider challenges such requests is set out in its contract. Ask about it and have the answer documented.
What if I do not know an answer?
Choose “unknown”. The check then shows what is open and adds matching questions for the provider. Most details are in the imprint, the contract, the DPA and the list of sub-processors. A reputable provider answers these questions in writing and without detours.
Does the check replace a transfer impact assessment?
No. The check shows whether a transfer to a third country is likely and which basis may apply. A transfer impact assessment for standard contractual clauses additionally assesses the law and practice in the destination country. You prepare that assessment with your DPO or a law firm.
Can I share the result?
Yes. The fact sheet sums up your inputs, the assessment and the open questions. Copy it into your vendor assessment, your DPIA or an email to the provider. The details come from you and are not verified, so note the source and date.
Questions about location? We answer them for RAGSuite in writing.
Seat, data centre, sub-processors and DPA of the RAGSuite Engine are in the Trust Center, or talk to us directly.