Glossary · Compliance
EU data residency
EU data residency is the guarantee that personal and operational data is stored and processed within the European Union — and, when it is residency by architecture, the data physically never leaves the EU rather than relying on a contractual promise layered over a US cloud.
In practice
Where your data physically lives
Most “EU residency” claims are a contractual promise stretched over US-headquartered infrastructure that can move or replicate data elsewhere. IRIS treats residency as a property of the architecture, not a clause: alert state lives in Cloudflare Durable Objects pinned to EU jurisdiction, on Cloudflare’s EU edge. That means the data is not merely promised to stay in the EU — it is placed there, structurally. For a regulated buyer, that removes a class of GDPR transfer risk instead of asking a lawyer to defend a clause if the legal basis for US transfers is challenged again.
EU data residency — frequently asked
What is the difference between data residency “by contract” and “by architecture”?
By contract means a vendor promises in a clause to keep your data in the EU, even though it runs on infrastructure (often a US cloud) that could move or replicate it elsewhere. By architecture means the data physically cannot leave the EU because that is where the compute and storage are pinned. IRIS uses the second form: alert state lives in Cloudflare Durable Objects pinned to EU jurisdiction.
Why do EU buyers in regulated industries care so much about residency?
Because GDPR restricts transfers of personal data outside the EU, and the legal basis for US transfers has been repeatedly challenged. For pharma, healthcare and other regulated operations, keeping data in the EU by architecture removes a class of compliance risk rather than papering over it with a clause that a court might invalidate.
Does IRIS support GDPR access and erasure on top of residency?
Yes. Residency is the foundation; on top of it IRIS supports GDPR Article 15 export and Article 17 erasure, STOP/START opt-out, configurable retention, and a DPA. Residency answers “where is my data”; those features answer “what rights do my data subjects have”.
See how IRIS makes EU data residency structural — plus GDPR, DPA and opt-out.
Compliance & EU residencyAlerting that stays in the EU
Start free with 1,000 credits — no credit card — on EU-resident infrastructure.