01 / DATA
Where is each dataset processed?
Check operational databases, backups, monitoring logs, AI requests, support tickets and email, not just the marketing statement about the primary database.
DATA & GOVERNANCE
What does EU data residency mean?
Understand how data location, suppliers, backups, support access and processing contracts fit together.
Practical tools. Clear advice. Real decisions.
DISTINGUISH THE TERMS
A contract is not a physical storage location.
A data processing agreement governs processing responsibilities between organisations. It does not, on its own, demonstrate where a database or backup is hosted, where support staff connect from, or whether third parties can access information.
An app may use a European database while another service processes prompts, analytics, email notifications or logs elsewhere. A correct residency statement needs to consider each relevant data flow.
EU hosting can support a particular data strategy, but it is not a declaration of GDPR compliance. The applicable legal basis, transparency, access controls and international transfers still need assessment.
FOR AN APPLICATION OWNER
Questions to put to every supplier
02 / ACCESS
Who can access information?
Review permissions, privileged support access, sub-processors and where any administration is performed.
03 / CONTINUITY
How are backups handled?
Ask about encryption, storage region, restoration drills, retention windows and what happens at contract termination.
04 / ASSURANCE
What evidence can be supplied?
Request current contract terms, architecture information, published security commitments and responsible contacts.
Oakleaf's Managed EU Hosting
Oakleaf describes its Managed EU Hosting service as using Amsterdam for the application data store and Frankfurt for encrypted backups. The precise contractual scope, limitations and current service descriptions are documented on the Managed EU Hosting service page and the application data-flow mapping checklist, and the relevant data processing agreement should be read before any purchasing decision.
For an example of why a DPA and a data region are different issues, read Oakleaf's OverSkill DPA explainer. Third-party terms can change; verify them at the original provider.
Further reading: Information Commissioner's Office, UK GDPR guidance.
This is general information about technical and contractual questions, not legal advice or confirmation that any particular architecture is compliant.
Need clarity about an app's data location?
Start with the application platform, the data you hold and where your users are based.
Ask about data hosting