Data Residency Explained

What is data residency and why it matters for EU companies in 2026?

You’re a company in Berlin. Your users are in France, your servers are in Virginia. You’re sending their data across the Atlantic without realizing it. One day, a regulator asks you: “Where is your data stored?” You can’t answer. That’s the real risk of ignoring data residency in 2026.

Data residency isn’t just about geography—it’s about control. It means your data must stay within legally defined borders, especially the EU for EU-based organizations. This isn’t a suggestion; it’s a requirement under GDPR, a reality for your compliance, and a necessity for trust.

In this article, you’ll learn exactly how data residency works technically and legally, why it’s non-negotiable for EU companies in 2026, and what you must do—whether you’re using a hosted service or self-hosting—to keep your data where it belongs.

Key takeaways

Data residency means EU data must be stored within the EU to comply with GDPR and avoid fines.
Even if your email provider is “secure,” data stored outside the EU may be accessible to foreign governments under laws like the US CLOUD Act.
Self-hosting or choosing a provider with confirmed EU data centers is essential to enforce true data residency.

How does data residency actually work in practice?

You sign up for a cloud service, and your emails, files, and contacts get stored on servers in a specific country. If those servers are in the US, Canada, or Asia, your data could be accessed by foreign governments under laws like the US Cloud Act—even if you're based in the EU. Data residency means keeping EU data within the EU or in countries the European Commission deems to have adequate protections, like Switzerland or Canada. This isn’t just paperwork—it affects who can see your data and under what legal authority.

Where your data lives matters more than you think

Think about that: when you use a popular hosted service, your data might physically reside in a data center in Virginia or Tokyo. Even if the service claims "privacy by design," foreign laws can still force disclosure. The EU’s GDPR requires that personal data of individuals in Europe not be transferred outside the EU unless the receiving country offers "adequate" protections. This isn’t theoretical—it’s enforced by regulators. The European Commission publishes an official list of adequacy decisions, which you can check at the European Commission’s site.

Let’s be clear: being "in the EU" doesn't mean "processed in the EU" if the provider stores data in a US-based cloud region. Many companies claim to "protect privacy," but if their infrastructure is global and default to US or Asian data centers, that claim is hollow. The Cloud Act already enables US agencies to access data stored abroad—no court order in the EU required.

How self-hosting changes the rules

When you self-host a solution like Unifiedesk, your data never leaves your control. You choose where to run the servers—on-premise, in a German data center, or in a cloud provider located in the EU. That means your email, calendar, Drive files, and contacts stay within your jurisdiction, even across borders. This is the only way to guarantee full compliance with data residency rules without relying on third-party assurances.

With Unifiedesk, you can set up your own custom domain and store all data at rest using per-account AES-256-GCM encryption—your keys, your control. You can manage this from your own private infrastructure, with no third-party access. If compliance is non-negotiable (for healthcare, legal, or financial data), self-hosting is the only viable path.

Want to see how this works end-to-end? Try setting up a private email with Unifiedesk using your own domain in minutes: set up custom domains. You’re no longer just a customer—you’re the owner of your data’s location.

Why does the EU care about data residency?

You're required under GDPR to ensure personal data of EU residents stays protected — including whether it’s stored inside the EU or transferred overseas. If data leaves the EU without proper safeguards like an adequacy decision or binding contracts, you risk fines up to 4% of global revenue. The EU doesn’t just want privacy — it wants control over where data goes.

Under GDPR, data residency isn’t just a preference — it’s a legal requirement. If your company handles EU data, you must assess where it’s stored and processed. Even if the data is encrypted, the location still matters because jurisdiction determines which laws apply.

Take a French startup using a U.S.-based cloud provider with no adequacy decision. Even with encryption, if authorities in the U.S. can access that data under FISA or other laws, GDPR still considers the transfer risky. The European Data Protection Board (EDPB) has clarified that data exported to the U.S. without safeguards like Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework is not automatically compliant.

What happens if you don’t comply?

Non-compliance can mean enforcement actions — including hefty fines, audits, or even restrictions on processing data. The French data authority (CNIL), for example, has fined companies for storing EU data in jurisdictions where legal access by foreign governments isn’t adequately restricted.

Let’s be clear: GDPR isn’t just about encryption or consent — it’s about where data lives and who can access it. If your organization collects or processes data from EU residents, you must know your data’s physical location, and you must be ready to justify it.

With Unifiedesk, you can keep data in the EU or at your own data center. Whether you choose our self-hosted option or our compliant hosted platform, your data never leaves your chosen jurisdiction without your explicit control.

And if you host your email on a custom domain, set up with our custom domain setup, you ensure all data — from emails to shared documents to meeting recordings — stays where you want it. That’s how privacy becomes practical.

For full transparency on how data is managed, visit our security overview. No promises. Just architecture.

What happens if EU data is stored outside the EU?

If your EU-based company stores personal data outside the European Union—say, in the U.S.—that data may become accessible to foreign intelligence agencies under laws like the U.S. Cloud Act. This creates a legal conflict with the GDPR, which prohibits transfers to countries without an adequate level of data protection. Even with Standard Contractual Clauses (SCCs), you’re not fully shielded from legal exposure, since courts may still rule that the data isn’t meaningfully protected.

Why the Cloud Act and EU law clash

Let’s be clear: the U.S. government can compel U.S.-based providers to hand over data, regardless of where the user is located. This means that even if you’re an EU company using a U.S.-based cloud service, your data could be accessed without your knowledge or consent. The GDPR says this kind of access undermines data protection, especially when the data isn’t covered by strong legal safeguards.

SCCs aren’t a silver bullet

SCCs are a common way to legally permit cross-border transfers, but they don’t guarantee protection. The European Court of Justice ruled in 2020 that relying solely on SCCs isn’t sufficient if the recipient country’s laws (like the U.S. Cloud Act) allow for mass surveillance. That means you still need to assess whether the data transfer is lawful under the real-world legal environment—something most providers don’t fully disclose. The EU’s own data protection authorities have made this clear: SCCs reduce risk but don’t eliminate it.

Some services claim “GDPR-compliant” storage, but that doesn’t mean data is physically or legally isolated from foreign access. The real question isn’t just where the data is stored—it’s who can access it, and under what authority.

If you’re an EU company storing email, documents, or calendar data, you need full control over where that data lives and who can access it. With Unifiedesk, you can run your workspace in the EU or anywhere you choose. Onboard your domain in minutes and keep your data where it belongs—with you, not a foreign cloud provider. Self-hosting gives you total sovereignty, while our cloud platform ensures your data is encrypted at rest and in transit, with no third-party access to keys.

How do major cloud providers handle data residency?

Major cloud providers like Google Workspace and Microsoft 365 store your data across global regions—including servers in the United States—even if you're an EU-based company. While they claim to offer data residency options, these are often limited to specific zones or require special contracts that don't cover all data types, leaving your information potentially subject to foreign legal access under laws like the US CLOUD Act.

Residency claims don’t always mean what they seem

Let’s be clear: just because a provider says your data stays in the EU doesn’t mean it’s truly locked in. Many offer “data residency” zones, but those often apply only to specific services or geographies, and can be bypassed by backend systems or shared infrastructure. For example, even with EU-only data placement, metadata and logs might still flow to US-based nodes.

These options commonly require contracts with high administrative overhead, and even then, they don’t guarantee immunity from foreign government access. Courts in the host country—like the US—can legally compel providers to hand over data, regardless of where you’re based or what your contract says. The EU’s own General Data Protection Regulation (GDPR) mandates data protection, but it doesn’t override foreign legal obligations that override contractual promises.

What happens when your data is subject to foreign laws?

Even if you’re an EU company using a US-based provider, your data could be accessible to US authorities through mechanisms like the CLOUD Act. This isn’t hypothetical—research from institutions like the Electronic Frontier Foundation (EFF) has documented real-world cases where US agencies accessed data stored abroad under broad legal authority.

Providers claim to protect your data with encryption and access controls, but these don’t stop legal demands. You can't control what courts can force a hosting company to disclose. That’s why data residency isn’t just about geography—it’s about jurisdiction, legal risk, and enforceability.

For EU companies that want true control, self-hosting or using a fully private solution with explicit data sovereignty is the only way to ensure data stays within your legal boundaries. With Unifiedesk, your data is stored exactly where you choose—whether in a private server, on-premise, or in a hosted region you designate, with encryption that stays under your control. Try Unifiedesk self-hosted or set up a custom domain with full ownership of your data’s location and access.

How does Unifiedesk ensure EU data residency?

You can trust that your data stays in the EU with Unifiedesk. The hosted platform stores all data for EU-based customers exclusively in EU-based data centers, as enforced by architecture — data never leaves the region unless you explicitly configure and secure it yourself. This means even if you collaborate internationally, data remains within the EU boundaries by default.

Architecture that enforces data residency

Let’s be clear: this isn’t about promises. It’s about how the system is built. Unifiedesk’s hosted infrastructure uses geographically constrained deployments — your mail, calendar, Drive files, and contacts live in EU data centers only, unless you override it with explicit, secure configuration. This includes all metadata, file content, and user activity logs.

Think of it like a firewall with a single exit — that exit is outside the EU, but only if you actively open it. By default, it’s closed. Even automated processes like backups are confined to EU facilities unless you opt in with full control.

Full control with self-hosted deployments

If you need absolute ownership of where your data lives, self-hosting gives you that. You run Unifiedesk on your own infrastructure — on-premise, in a private cloud, or in a data center of your choice. This includes full control over network routing, storage geography, and compliance posture.

For EU companies under GDPR, this level of control eliminates any uncertainty about data flows. You don’t rely on third parties’ infrastructure locations. You decide where every byte goes. You can even host it in a country or region that meets your legal or regulatory requirements — such as Germany, France, or the Netherlands.

For more on the technical design, see Unifiedesk’s security documentation, which details how data is partitioned and secured at rest and in transit. The open-source engine means transparency: you can audit the code, confirm the architecture, and verify that no data leaves your control unless you allow it.

Whether you use the hosted platform or self-host, the goal is the same: privacy by design, with EU data residency as a core constraint, not a footnote. It’s not just a feature — it’s how you build trust.

Need to move your email, calendar, or documents to a European provider with real data control? Try a custom domain setup in minutes — and keep your data local. With Unifiedesk, you’re not just compliant. You’re in control.

What’s the difference between hosted and self-hosted data residency?

With hosted Unifiedesk, your data lives only in EU data centers—guaranteed by design, no exceptions. With self-hosted Unifiedesk, you control exactly where your data resides: deploy it on your own servers, in your national data center, or even behind your corporate firewall. This makes self-hosting the most reliable choice for companies in highly regulated sectors or those with strict data sovereignty rules.

Hosted: Built-in EU-only residency, ready to use

If you’re using the hosted Unifiedesk service, your data is stored exclusively in EU locations, as defined in our infrastructure. We don’t offer options to move data outside the region—you don’t need to configure anything. This is a core feature, not a configurable setting. For EU-based companies managing employee or customer data, this eliminates the risk of accidental data transfer across borders.

The EU’s GDPR places strict limits on cross-border data flows, and having a provider that guarantees EU residency can simplify compliance. According to Article 44 of GDPR, transferring personal data outside the EEA requires a legal basis; using a provider that never leaves the EU removes that complexity entirely.

Self-hosted: Full control over where data lives

With self-hosted Unifiedesk, you’re not relying on someone else’s infrastructure. You install the software on your own servers—anywhere you choose. Whether that’s your own data center, a local cloud provider, or even an on-premise server, the data stays under your authority.

This level of control is critical in regulated industries—healthcare, finance, or public sector work—where legal requirements demand that data never leave a specific jurisdiction. For example, German companies must comply with Bundesdatenschutzgesetz (BDSG), which imposes stricter rules than GDPR in some cases. Self-hosting ensures compliance by design.

You can also use self-hosted Unifiedesk to meet internal policies that forbid third-party data handling—even if the provider claims to store data in the EU. When you control the deployment, you control the data’s location, transit, and access.

You can trust Unifiedesk to meet EU data residency requirements by default: hosted services keep your data within the EU for EU-based users, and all data is encrypted at rest with per-account keys. Built-in tools like audit-ready logging and end-to-end encryption help you stay compliant with GDPR and other privacy laws—no extra tools or setup needed. Whether you use the cloud or self-host, you retain control over where your data lives.

Hosted services: data stays where it should

If you're an EU-based company, your data never leaves the EU on the hosted Unifiedesk platform. This is built in—no configuration, no risk. All email, calendar, Drive, and document files are stored in EU data centers, and encryption happens at rest using AES-256-GCM under per-account keys. That means even if someone accessed the raw storage, they’d see only encrypted noise.

GDPR requires data processing to occur only where legal and lawful. Unifiedesk meets this by design: every component—mail, calendar, Meet, Docs—adheres to EU data residency rules automatically. You can verify this through the EU’s official framework on data protection, which emphasizes localization and encryption for sensitive personal data. With Unifiedesk, you're not just compliant—you’re built for it.

Self-hosting: full control over data flow

For companies with stricter needs—like public sector or national data laws—Unifiedesk offers a self-hosted option. You install the software on your own servers, giving you total control over where data is stored and how it moves. This means you can align with national laws beyond the EU, like Germany’s BSI guidelines or France’s ANSSI framework.

Self-hosting doesn’t mean sacrificing features. You still get JMAP, IMAP, and SMTP access with full support for encryption, audit logs, and DKIM-signed outbound mail. With self-hosted Unifiedesk, your organization sets the rules—no third parties involved, no data exposed.

From calendar events to shared drives and AI-assisted documents, everything runs with encryption by default. Per-account keys ensure that only you (or your admins) can decrypt data. No user data is shared with upstream providers or used for profiling.

Whether you're using the hosted platform or self-hosted, Unifiedesk gives you tools designed for real compliance—not just marketing. Your data stays yours, wherever you choose to run it.

What you should ask before choosing a workspace suite as an EU company

You need to know where your data lives, whether it stays within the EU by default, and if you can control storage locations—even with your own hardware. Don’t assume "European provider" means "data stays in Europe." Ask about data center locations, legal access, and what metadata gets stored where. The real test is transparency and control, not marketing.

Check the fundamentals

Where are the data centers physically located? Not just "in Europe" — specify the country. A provider that says "EU" without a country may be routing data outside.
Can you guarantee that all user data—including email logs, file metadata, and AI processing outputs—is stored only in EU data centers? Ask for a clear, documented policy.
Does the provider offer a contract or SLA that enforces data residency within the EU under GDPR? A weak promise isn’t enough.

Control and transparency matter

Can you choose the region for data storage, even in a hosted setup? Some providers lock data to one region; others allow multi-region selection. That’s control.
Do they share data with third parties or governments? Look for a published transparency report. Electronic Frontier Foundation tracks how companies respond to government requests—no one should hide that.
Can you audit or see where data resides? If they won’t tell you, they’re not compliant with GDPR's accountability principle.
For AI tools, is your data sent to external servers for processing? If yes, you lose control. Ask: "Is AI processed in my region or outside it?"
Can you self-host the entire suite to ensure complete data sovereignty? Self-hosting gives you full control over data location, even in a single office.
Does your workflow involve file sharing? Ensure shared files are stored in the EU and that expiring share links don't trigger external logging.

Let’s be honest: most “EU-based” cloud services still store backups or logs in the U.S. or Asia. That defeats the purpose. The best approach? Ask for proof, not promises. A real provider will show you records, let you verify data flow, and offer real control—whether you use their service or run it yourself.

“Data residency is not about location alone—it’s about control, accountability, and compliance.”

How to check if your current email provider meets EU data residency standards

You can verify if your email provider complies with EU data residency rules by confirming their data centers are located within EU member states, checking for explicit commitments to EU-only processing, reviewing their use of Standard Contractual Clauses (SCCs), auditing your domain’s DNS records for non-EU endpoints, and requesting a formal Data Processing Agreement (DPA) that enforces data residency. This isn’t just about location—it’s about control and legal protection under GDPR.

Check the provider’s website for data center locations Look for explicit mentions of servers in Germany, France, the Netherlands, or other EU countries. Providers that don’t list locations or only reference the U.S., Singapore, or the UK may not meet strict EU data residency requirements.
Look for "EU-only" or "data stored in the EU" language Avoid vague terms like “worldwide” or “global infrastructure.” Focus on claims like “all data processed in the EU” or “EU-based data centers”—these are signs of intentional compliance, though they shouldn’t be taken as absolute guarantees.
Verify use of Standard Contractual Clauses (SCCs) Most providers still rely on SCCs to legally permit cross-border data transfers. While SCCs are required for international transfers under GDPR, they don’t shield data from foreign government requests, such as those under the U.S. CLOUD Act, unless supplemented by stronger contractual or technical controls. You can review the EU’s official SCCs template at the European Commission’s page.
Test your domain’s DNS records for non-EU servers Use tools like MxToolbox or Spamhaus to analyze your domain’s MX, SPF, and DKIM records. If any third-party services (e.g., marketing, analytics, or email routing) are hosted outside the EU, they may still process your data—even if your primary mailbox is EU-based.
Request a formal Data Processing Agreement (DPA) If compliance is critical, don’t rely on marketing language alone. Ask your provider for a DPA that explicitly includes data residency guarantees. A properly drafted DPA can enforce where data lives, who accesses it, and how long it’s retained.

Why DNS verification matters

Your email address might be hosted in the EU—but if your DNS records point to a U.S.-based mail relay, or your provider uses third-party analytics or backup services outside the EU, your data could still leave the bloc. For granular control, examine your SPF, DKIM, and MX records: they reveal every server touching your messages.

Self-hosting offers clarity

If you need full control over where data resides, consider self-hosting. Unifiedesk’s self-hosted version lets you run your entire workspace—mail, calendar, drive, documents, video meetings—on your own servers with data stored entirely where you choose. No third parties. No hidden locations. You know exactly where your data lives.

This is not about fear—it’s about predictability. If you can’t answer where your data lives, you don’t own it.

The bottom line: sovereignty begins with where your data lives

What is data residency? It’s not a checkbox on a sales page. It’s the foundation of control, compliance, and true digital sovereignty.

For EU companies, storing data outside the EU without proper safeguards is a legal risk — not a technical one. You can’t comply with GDPR if your data lives in a jurisdiction with weaker privacy laws.

Unifiedesk puts you in control

Our hosted service stores all data in the EU by default — no exceptions, no hidden clauses.
Or, self-host it on your own servers. You choose the location, the rules, and the tech stack.
Either way, encryption is always on, your data stays yours, and your compliance obligations are met.

Keep reading

Ready to put this into practice? Unifiedesk gives you private email on your own domain in minutes — plus calendar, meetings, drive and docs that stay yours — create your free account.

Frequently asked questions

What is data residency in simple terms?

Data residency means your data must be stored in a specific country or region — for EU companies, this usually means within the European Union or in countries recognized as having adequate data protection.

No — data residency is a key part of GDPR compliance, but not the only one. GDPR also covers consent, data minimization, breach notification, and processing transparency.

Can I move my data to the EU if my provider stores it overseas?

Only if the provider supports migration or offers EU data centers. Otherwise, you may need to switch providers entirely.

Do free email services respect data residency?

Most free services store data globally, often in the US. Free @unifiedesk.com addresses are hosted in the EU and comply with data residency requirements.

How does self-hosting improve EU data residency?

Self-hosting lets you run Unifiedesk on your own servers in your own data center — guaranteeing your data never leaves your chosen location.

What encryption does Unifiedesk use for data at rest?

In self-hosted deployments, every message and file is encrypted at rest with AES-256-GCM under per-account keys. Hosted Unifiedesk is end-to-end encrypted by default.

Can EU companies use Microsoft 365 or Google Workspace safely?

They can, but only with careful controls. These platforms store data globally and rely on third-party agreements that don’t fully eliminate foreign access risks.

Check for a Data Processing Agreement (DPA), transparency about data centers, and proof of EU data residency commitments. Be wary of vague claims like 'secure' or 'privacy-focused'.

Is the AI assistant in Unifiedesk compliant with data residency rules?

Yes — the AI assistant uses your chosen OpenAI-compatible endpoint. When self-hosted, data never leaves your infrastructure. When hosted, the AI runs in EU data centers.

Can I test Unifiedesk with my domain and verify data residency?

Yes — you can add any custom domain to Unifiedesk and generate live MX, SPF, DKIM, and DMARC records within minutes. The hosted service ensures your data stays in the EU.

What happens if a foreign government requests my data?

With Unifiedesk hosted in the EU, such requests would require formal legal process through EU authorities. Self-hosted instances prevent foreign access by design.

Does Unifiedesk support data minimization?

Yes — Unifiedesk allows per-account encryption, expiring share links, and minimal data retention. You control what is collected, stored, and shared.