What “EU data residency” actually means for an LLM API

If you buy AI infrastructure in Europe, you have read the same sentence a hundred times: “We take data protection seriously.” It tells you nothing. Data residency is not a vibe — it is a set of verifiable claims about where computation happens, who can access the data, and which jurisdiction's courts can compel access to it.

This post is the checklist we use internally, written down. It is also the spec EU-Router is built against, so it doubles as an explanation of our architecture.

1. “EU company” is not “EU processing”

A vendor can be incorporated in Dublin or Berlin and still route your prompt to a GPU cluster in Virginia. The legal seat of the company and the physical location of inference are independent facts, and only the second one determines where your data physically goes. Ask for the region list, in writing, per endpoint — not a marketing page that says “European”.

2. Follow the subprocessors, not the sales deck

Under GDPR, your vendor's subprocessors are effectively your subprocessors. A gateway that proxies to ten model providers is making a residency claim about eleven companies, not one. For every model on the route you should be able to answer: which legal entity processes the prompt, in which data center, under which data processing agreement?

EU Router records provider and processing-policy facts per route. A route is eligible only after its policy and price records have been configured. Open model weights and a European company address do not by themselves establish a European processing chain.

3. Retention is a number, not an adjective

“We don't store your data” is unfalsifiable. “Prompt and completion logs are retained for 0 days by default, configurable up to 30, and deletion is exposed as an API call” is falsifiable. Ask for the default, the maximum, and the deletion mechanism. If the answer involves emailing support, plan accordingly.

4. Training exclusion must be contractual

When you reach a model through a gateway, check the training policy across the processing chain. EU Router route eligibility requires recorded no-training evidence; an unsigned or unverified agreement is not treated as proof.

5. Residency you can't observe is residency you don't have

Claims need ongoing verification as providers change their infrastructure and policies. EU Router keeps the selected route and policy version with request records. Region headers, external exports and independent monitoring should only be claimed when their deployed behavior has been verified.

The question is never “are you GDPR compliant?” It is “show me the region header on last night's batch job.”

The short version

• Get the processing regions per endpoint, in writing.
• Get the subprocessor list, including the gateway's upstreams.
• Get retention as a number, with an API to delete.
• Get training exclusion in the contract, not the FAQ.
• Get per-request region evidence you can monitor yourself.

We built EU-Router because we were tired of asking these questions and getting PDFs. If your current vendor answers all five quickly and precisely — keep them. If not, you know where to find us.