"EU-hosted" is doing a lot of work in most vendor copy. Here is the more useful version of the question, and our own answer to it.
Every AI vendor selling into Europe now says it is EU-hosted. Almost all of them are telling the truth, and the claim is still much weaker than it sounds. "Hosted" describes where a server sits. It does not describe where your text goes once the server has it.
That gap matters because the interesting part of an AI product is the part that leaves. A database in Frankfurt is easy. A language model in Frankfurt is not, and most vendors do not have one.
If you are evaluating any AI vendor, these three separate what is genuinely EU-resident from what is EU-resident up until the moment it matters.
This is the easy one and the one everybody answers. You want a named region, not a country. "The EU" can mean a load balancer in Dublin in front of storage in Virginia. "eu-central-1" is a fact you can hold someone to.
This is the question that gets skipped. When a visitor types a question, that text has to reach a model. If the vendor uses a US frontier model - and if the answers are any good, it very likely does - then that text crosses the Atlantic on every single turn, no matter where the database lives.
This is not automatically a problem. Transfers to third countries are lawful under Chapter V of the GDPR when they are covered by an appropriate safeguard. It is a problem when a vendor implies it is not happening.
Payment processing, transactional email, error monitoring, the CDN. Each is a sub-processor, each needs naming under Article 28(2), and each is a place your data can be. Ask for the list. If a vendor cannot produce one in writing, that is your answer.
Applying our own three questions to ourselves:
At rest: your workspace, your conversations, your captured leads and your training data are stored in AWS eu-central-1 in Frankfurt. Encrypted with AES-256 at rest and TLS 1.3 in transit. That is the whole of the durable state.
In flight: conversation text is sent to model providers in the United States to generate a reply, and to convert your content into embeddings so the agent can find the right passage. We are not going to pretend otherwise, because it would be trivially false and it would be the exact thing this post is complaining about. These transfers happen under GDPR Chapter V safeguards.
The chain: every sub-processor is named publicly, with what it does and where it is. There are seven. If that list changes, the page changes.
It does mean your durable records - the leads, the transcripts, the training corpus, the thing that would matter in a breach - are under EU jurisdiction, in a named region, subject to a DPA you can actually read.
It does not mean no data ever touches a US company. Any vendor telling you that, while shipping answers from a frontier model, is either running something much weaker than they are implying or is not being straight with you.
The honest position is the boring one: keep the durable data in Europe, name every party that touches the rest, and cover the transfers properly. That is what we do, and we would rather you hold us to it than take the marketing line.