Data Residency
Where an AI tool stores and processes a business's data, such as inside the EU or in another region. Providers state it per product and per plan, so EU residency cannot be assumed across every tool carrying the same name.
What Data Residency means
Data residency is where an AI tool stores and processes a business’s data, such as inside the EU or in another region. It sounds like a single setting. In practice the site’s comparisons find it is stated per product and per plan, so a business cannot assume it from the brand on the box.
It is also narrower than it looks. Residency answers where data sits. It does not answer whether a use is lawful, whether the data is used for training, or whether the right people can reach it. Those are separate questions, which is why this page keeps returning to what residency does not settle.
Storage, processing and routing
Three words get used as if they meant the same thing, and the reviews show they do not. Storage is where content is held at rest. Processing is where it is handled when a request is answered. Routing is where traffic is sent on the way. A vendor can offer a choice on one and not on the others.
The Claude and ChatGPT comparison shows the difference in one case. Anthropic’s privacy centre says traffic can be routed to select countries in the US, Europe, Asia and Australia, while data is stored in the United States. A routing choice there is not a storage choice. A business whose policy is about where data sits at rest has to read which of the three a vendor is actually promising.
Why the name on the product is not enough
The definition on this page says providers state residency per product and per plan. The comparisons give three clear cases of the same name covering different things.
The Copilot and Google Workspace comparison says an administrator can choose the EU as the data region for Gemini’s Workspace integrations, and warns against assuming EU residency applies by default across every product carrying the Gemini name. The Gemini and ChatGPT comparison adds that this option covers Gemini’s Workspace integrations and not the separate consumer Gemini app. The ChatGPT and Copilot comparison finds a boundary that covers some models inside one product and not others.
Neither statement is a blanket guarantee. That is exactly why a plan has to be read, not assumed.
What vendors state, as the Reviews report it
These are vendors’ own statements, quoted as the site’s reviews report them. The site does not verify them, and vendors change them, so the current plan page is the thing to read before a decision.
OpenAI. The Claude and ChatGPT comparison reports that eligible customers on ChatGPT Enterprise, Edu and the API platform can choose data residency in Europe, with content then stored at rest in the region, including conversations in Enterprise and Edu workspaces. The Gemini and ChatGPT comparison adds that residency is offered in the EEA and Switzerland, alongside other regions, for Enterprise, Edu and API customers.
Anthropic. The Claude and ChatGPT comparison reports that for Claude’s own products data is stored in the United States, with a choice over where traffic is routed. Regional residency across Europe is described for Claude deployed through the regional offerings of the major cloud platforms, and not for the Claude apps and API as sold directly.
Microsoft. The ChatGPT and Copilot comparison reports Microsoft’s statement that its EU Data Boundary keeps EU traffic for its own and OpenAI’s models inside the EU. In the same documentation, Microsoft says models supplied by Anthropic as a subprocessor are currently excluded from that boundary. The Copilot Chat comparison reports the boundary as stated for Copilot Chat and both Microsoft 365 Copilot positions alike, and notes the same exclusion. Which underlying model Copilot uses for a task decides whether the commitment applies.
Google. The Gemini and ChatGPT comparison reports that administrators can keep Gemini’s Workspace integration data inside the EU through Google’s data-region controls.
What Residency does not settle
Residency is one part of data protection, and not the whole of it. The Claude and ChatGPT comparison is direct about the limit. Transfers outside the EU can be lawful when the right safeguards are in place, and that is a matter for a data protection officer. Where GDPR applies, a transfer outside the EU becomes a question to answer, but a location inside the EU does not discharge the other duties.
The cloud and on-premise comparison makes a related point. GDPR and EU AI Act obligations attach to what a system does with data, not to where it is hosted. Moving a workload does not by itself discharge a requirement. This page is not legal advice.
When Residency points to On-Premise AI
The cloud and on-premise comparison treats residency as one of the documented requirements a deployment is decided against, together with latency and volume, workload by workload. It names a genuine data residency requirement, a contractual restriction or an internal policy that rules out data leaving the organisation’s network as the case where on-premise AI suits.
It also describes a hybrid: workloads with a real residency requirement run on the organisation’s own infrastructure, and everything else goes to a cloud platform. The comparison says the workload comes first, meaning what data it touches and whether that data carries a residency or contractual restriction.
How to settle it before comparing Features
The Claude and ChatGPT comparison gives the shortest advice. A business whose policy says personal data stays in the EU has a direct answer from one provider and a different route to take with the other. If that policy is yours, settle it before comparing features.
In practice that means three steps. State the policy in one sentence: what data, which region, stored or only processed. Ask each vendor which product and plan that statement covers, and in writing. Then check the models a product calls on, as the Copilot example shows, because a boundary can cover some of them and not others.
A worked example
This is an illustration, not a real client. A small firm’s policy says client personal data stays in the EU. It is comparing two assistants. The first vendor offers a European storage option on its enterprise plan and the API, and the firm’s team is on that plan. The second stores data for its own apps outside the EU and offers regional storage only through a cloud platform’s own offering.
The firm does not rule either out. It notes that the first gives a direct answer, and the second needs a different route through a cloud deployment, with a data protection officer deciding whether any transfer is covered by safeguards. It then asks the first vendor whether every model and feature inside the product follows the same setting. The policy was settled first, so the feature comparison starts from a shortlist that fits it.
Mix-ups worth avoiding
Four confusions come up often enough to name. The first is treating residency as a yes or no for a vendor. It is a statement about a product and a plan. The second is treating a routing choice as a storage choice. The third is treating EU residency as the same thing as GDPR compliance, when it covers one part of it. The fourth is assuming one product’s boundary covers every model it uses.
Where it goes wrong
One failure is accepting a brand-level claim without asking which plan it covers. Another is settling residency after the team has already adopted a tool, so the question arrives as a problem. A third is assuming the answer stays fixed, when the comparisons report vendor statements at the time they were read.
The last is treating location as the answer to a different question. A tool can store data in the EU and still be used on data nobody approved. That is a data protection and governance matter, and residency does not reach it.
Where it appears in an Audit
An audit records where each tool in use stores and processes data, against the policy the business actually holds. A tool whose plan does not meet the policy shows up as a finding with a name on it, before the question is raised by a client or a regulator.
If you want that mapped for the tools your team already uses, a discovery call is the quickest way to find out which of them meet your policy and which need a different plan or route.
Sources
- Claude vs ChatGPT for business: OpenAI’s European residency, Anthropic’s storage and routing, the cloud-platform route, and the advice to settle the policy before features.
- ChatGPT vs Copilot for business: Microsoft’s EU Data Boundary and the exclusion of Anthropic-supplied models.
- Copilot Chat vs Microsoft 365 Copilot: the boundary across the three licence positions.
- Microsoft Copilot vs Google Workspace AI: the choosable EU region for Gemini’s Workspace integrations.
- Gemini vs ChatGPT for business: the EEA and Switzerland option, and the consumer app being outside the Workspace setting.
- Cloud AI vs on-premise AI: residency as a documented requirement, the hybrid option, and obligations attaching to what a system does.
FAQ
Questions about Data Residency
What is Data Residency?
Where an AI tool stores and processes a business's data, such as inside the EU or in another region. Providers state it per product and per plan, so EU residency cannot be assumed across every tool carrying the same name.
Is Data Residency the same as GDPR Compliance?
No. Residency answers where data sits, not whether a use is lawful. The Claude and ChatGPT comparison says transfers outside the EU can be lawful with the right safeguards, which is a question for a data protection officer, and a location inside the EU does not discharge the other duties.
Can a Business keep its Data in the EU with Claude or ChatGPT?
The two differ. The comparison reports that OpenAI offers European data residency for ChatGPT Enterprise and Edu workspaces and the API platform, while Anthropic states that data for Claude's own products is stored in the United States, with regional storage available through a cloud platform's own offering.
Does Copilot keep EU Data in the EU?
Not for every model. The comparison reports that Microsoft's EU Data Boundary covers its own and OpenAI's models, but that models supplied by Anthropic as a subprocessor are currently excluded from it. Which model Copilot uses for a task decides whether the commitment applies.
Can Gemini keep EU Data in the EU?
For Workspace, yes, by choice. The comparisons report that an administrator can choose the EU as the data region for Gemini's Workspace integrations. That option covers those integrations and not the separate consumer Gemini app, so the specific product matters.
Why can't a Business assume EU Residency across a vendor's products?
Because vendors state it per product and per plan. The reviews find the same name covering different things: a boundary that covers some models and not others, and a region setting for one product and not another. A brand-level claim is not a guarantee.
Does Hosting On-Premise settle the question?
It settles where the data sits. The cloud and on-premise comparison says GDPR and EU AI Act obligations attach to what a system does with data, not to where it is hosted, so moving a workload does not by itself discharge a requirement.
What should a Business settle before comparing Features?
Its own policy. The Claude and ChatGPT comparison says a business whose policy says personal data stays in the EU should settle that first. State what data, which region and whether stored or only processed, then ask each vendor in writing which plan that covers.
What it means for a Business
Residency answers where data sits, not whether a use is lawful. Transfers outside the EU can be lawful with the right safeguards, which is a question for a data protection officer, but a business whose policy says personal data stays in the EU should settle it before comparing features.
Ready to Put This to Work?
Tell us where your team is with AI and we will tell you honestly what would make the biggest difference.