Where Your Data Lives Matters: EU Data Residency and Why We Run in europe-west4

“Where is our data?” sounds like a question for the IT team. It’s actually a question for the general counsel, the DPO, and increasingly the client. Where data physically lives determines which laws govern it — and for European professional firms, that has become one of the most consequential decisions in choosing a tool.

What data residency actually means

Data residency is the physical and jurisdictional location where your data is stored and processed. It’s not about where the vendor is headquartered or where the website loads — it’s where the bytes sit and where the computation happens. And location decides jurisdiction: data stored in the EU is governed by EU law, including the GDPR.

That distinction has teeth. Under the US CLOUD Act, US-based providers can be compelled to produce data they control even when it’s stored outside the United States. So a US cloud vendor promising “EU storage” doesn’t fully remove the exposure — the provider’s home jurisdiction still reaches the data. For a firm handling confidential client material, that’s not a hypothetical; it’s a risk to disclose.

Storing data in Europe and being reachable only under European law are two different things. Firms should care about both.

Why this became a strategic issue, not just a legal one

European policymakers now treat data location as a matter of digital sovereignty. The direction of travel — from the EU AI Act to national procurement rules — favours providers who can keep European data under European control. For a firm, choosing an EU-native stack isn’t only about avoiding risk today; it’s about aligning with where regulation and client expectations are heading.

It also connects to the GDPR-native idea: data residency is one of the concrete architectural choices that separates a genuinely EU-first product from one with a compliance page bolted on.

Why Docent runs in europe-west4

Docent runs entirely within the EU, in Google Cloud’s europe-west4 region — a data-centre location in Eemshaven, in the north of the Netherlands (Google’s region list). Every stage of the pipeline stays there:

• Storage: your documents are stored in the EU.
• Embeddings & retrieval: the RAG index that powers search is built and queried in the EU.
• Generation: the AI that writes grounded answers runs in the EU.

Nothing in the working path sends your knowledge outside European jurisdiction. Combined with tenant isolation and a GDPR-native design, that means a firm can adopt AI without its most sensitive material leaving the EU — the concern at the heart of adoption for accounting and law firms.

What to ask any vendor

If you’re evaluating AI tools, the residency questions worth asking are concrete:

1. In which region/country is our data stored and processed?
2. Where does the AI inference run — the same region, or somewhere else?
3. Is the provider subject to non-EU jurisdiction that could compel disclosure?
4. Is our data used to train shared models, or only to answer our own queries?
5. Can you show evidence — certifications, attestations — not just claims?

We keep our own answers to these public and verifiable on the Trust page.

The takeaway

Data residency is where compliance, security, and sovereignty meet. For European firms, keeping knowledge inside the EU — genuinely, end to end — is the difference between adopting AI as a controlled asset and adopting it as an undisclosed risk. That’s why Docent runs where it does.

Next in the trust series: the EU AI Act and the Code of Practice. Follow Docent on LinkedIn.