A law firm picks a "100% European" host for its client extranet. Contract mentions Paris. Six months later, GDPR audit asks backup location: replicated in Virginia via vendor object storage. CDN serves assets from global PoPs. Technical support with admin access is based outside the EU. Nothing was explicitly lied — everything was unsaid.
"European hosting" became a slogan. Like "GDPR compliant" on a badge. Serious choice is not about HQ flag but every data copy, every subprocessor, every privileged access.
Three origins not to confuse
| Origin | What it suggests | What it does not prove |
|---|---|---|
| EU HQ | Commercial jurisdiction | Server location |
| Advertised datacenter | Main production | Backups, logs, DR |
| "European" brand | Local marketing | No underlying US cloud |
GDPR talks about transfers and subprocessors, not hosting patriotism.
Mapping to require before signing
Before signing, require written mapping covering:
- Production region — city and underlying cloud vendor if applicable.
- Replication and DR — same region, another EU country, or outside EU?
- Backups — frequency, encryption, tested restore location.
- Logs — monitoring, support access: where stored?
- CDN — default PoPs; EU-only option?
- Subprocessors — transactional email, payment, analytics: DPA list.
- Admin support — remote access from which jurisdictions?
See Real location investigation and Cloud Act and contract.
European cloud vs hyperscaler EU region
| Criterion | Sovereign / EU vendor | Hyperscaler EU region |
|---|---|---|
| HQ & jurisdiction | Often EU | Possible US parent |
| Cloud Act | Contractual argument | Published policy to read |
| Portability | Variable | Standard APIs |
| Certifications | SecNumCloud, HDS by vendor | ISO, SOC2, partial HDS |
| Price | Sometimes premium | Global scale |
No universal choice. Standard B2B SaaS may suffice in eu-west. Health or public sector needs HDS or SecNumCloud on the right scope — see GDPR, HDS, SecNumCloud.
Warning signs in sales discourse
- "Data in Europe" without copy map.
- "GDPR compliant" without signable DPA before purchase.
- "Included" CDN without geo-restriction option.
- "24/7 support" without admin access mention.
- "Transparent migration" without post-migration audit.
Complementary technical tests
Network trace and IP from production instance. Backup restore in staging — where do files come from? CDN headers on assets — which PoP? Subprocessors in processing register vs real stack.
The peak: the flag hides a global chain
Compliance is born from contract + architecture + evidence, not from the country on the invoice alone.
Before signing, ask for a diagram covering production, backups, logs, CDN PoPs and support admin access — then compare vendors on identical scope via the directory.
Decide and move forward without blind spots
Request full mapping — production, backup, logs, CDN, support — before signing. Sign the DPA before production and list all subprocessors. Test a restore and note real source region. Enable EU-only CDN if clients are sensitive. Compare on identical criteria via directory and comparator.
Frequently asked questions
Does a French host always host in France?
No — verify the region chosen in your contract annex. Many European vendors are multi-region and default PoPs may sit outside France even when HQ is French.
Does "Made in EU" suffice for GDPR?
No — you need a signed DPA, listed subprocessors, documented legal basis and proven data locations. Marketing origin is not a compliance certificate.
How to verify real location?
Read contract and DPA, run network traces from production, map backups and logs, and test a restore to see where files actually originate.
European host vs US subsidiary?
Read contract jurisdiction and published Cloud Act policy. EU servers alone do not automatically immunize you against extraterritorial requests.
Choosing European hosting means tracing data path — not applauding the flag on the pricing page.