Quick answer: "Hosted in the EU" tells you where a vendor's database is. It does not tell you where every request is processed, which other companies touch the data on the way, or whether the vendor can show you the paperwork. When you compare analytics tools, ask four separate questions: where is the data stored, where is it processed, who are the subprocessors and under which safeguard do transfers happen, and what documents will the vendor give you. This post is a checklist for asking them, and it does not replace your own legal review.
Key takeaways
- Storage and processing are different. A database in Frankfurt and a request served by an edge network can both be true of the same product.
- Look for specifics: a region, a list of subprocessors, a named transfer safeguard. Vague claims such as "GDPR compliant" are not evidence.
- What the tool collects matters as much as where it sits. No IP address and no cookies means less data to protect in the first place.
- Ask for the documents: a data processing agreement, a subprocessor list, a retention statement.
- Nothing here is legal advice. Your obligations depend on your full setup and your jurisdiction.
Storage is not processing
Most vendor pages say where data is stored: "our servers are in Germany", "all data stays in the EU". That is useful, and it is only one part of the picture.
- Storage is where the data rests: the database region.
- Processing is everything that happens to data on its way: the server that runs the application, the content delivery network that terminates the connection, the service that sends emails, the tool that records errors.
A request can touch several companies before it reaches the database. If any of them runs outside the EU, or is owned by a company outside the EU, the data may be processed there even when it is stored in the EU. That is not automatically a problem, but it means "EU-hosted" alone cannot answer the question you actually have, which is whether this setup is acceptable for you.
The GDPR addresses it in two places. Article 28 requires a contract with every processor. Chapter V (Articles 44 to 49) sets the conditions for transferring personal data outside the EU, such as an adequacy decision or standard contractual clauses. A good vendor explains which of these applies to each provider it uses.
A worked example: reading a vendor's own statement
It helps to see what a specific, honest disclosure looks like. useClick's privacy policy states that its database, including all link, click and website analytics data, is hosted by Supabase in Frankfurt, Germany, and that the application runs in Vercel's Frankfurt region. It then says plainly that Vercel and Cloudflare are US companies that serve some requests from their worldwide edge networks, that email, payments and Google services involve US companies or US parents, that error data is stored in an EU region, and that requests can therefore be processed outside the EU, for example while a click is redirected. It adds that transfers outside the EU use a safeguard under Chapter V, and refers to a public subprocessor list with the safeguard for each provider.
Whether you find that acceptable is your decision. The point is the shape of the disclosure: a region, named providers, the plain admission that edge processing exists, and a named legal basis for transfers. Compare any vendor's statement with it. If a vendor says only "EU hosting" and nothing else, you have learned only the first of four things.
The buyer's checklist
| # | Question | What a good answer looks like | Red flag |
|---|---|---|---|
| 1 | Where is the database? | A named region and country | "Europe" or no region at all |
| 2 | Where does the application run? | A named region | Silence, or "the cloud" |
| 3 | Which subprocessors are involved? | A public list with name, purpose and location | No list, or a list that is only available on request |
| 4 | Which are non-EU companies or have non-EU parents? | Stated openly, with the safeguard for each | Not mentioned |
| 5 | Are requests ever processed outside the EU? | A direct answer, with the reason | Claims that nothing ever leaves the EU, without detail |
| 6 | What is collected per visit? | A clear list, including whether IP addresses and cookies are involved | "Anonymous" with no explanation |
| 7 | How long is data kept? | A retention period and an automatic deletion process | "As long as needed" |
| 8 | Is there a data processing agreement? | A published agreement under Article 28 | None, or only a promise to send one |
| 9 | How do I delete my data? | Self-service deletion and an export | Contact support |
| 10 | What happens when subprocessors change? | A notification process | Not addressed |
Ask these in writing. A vendor that answers precisely, including the uncomfortable rows, is usually one you can work with.
What the tool collects matters as much as where it runs
Hosting location is a risk-management question. The first risk reduction is collecting less. Two tools can both be hosted in Frankfurt, and one stores IP addresses and sets cookies while the other does neither. The second leaves you with less personal data to protect, fewer things to disclose and, in many setups, a simpler consent situation. See do you need a cookie consent banner? for how the cookie question works, and cookieless website analytics for how visitors can be counted without them.
For example, the useClick website analytics docs state that the script sets no cookies and that no IP addresses are stored. To count unique visitors, it builds a one-way hash from the IP address, user agent, site ID and the current date, and the date is part of the hash, so the same person counts as a new visitor on a new day. That is the kind of specific, checkable statement to look for. It also shows a trade-off: you give up multi-day visitor identity in exchange for not keeping anything that identifies a person across days.
What evidence to ask for
Claims are cheap, documents are not. Before you commit, ask for:
- The data processing agreement. Under Article 28, if the vendor processes personal data on your behalf, you need a contract with it. Read who the parties are, what data is covered, how long it is kept and what happens at the end. useClick publishes its data processing addendum so you can read it before you sign anything.
- The subprocessor list, with locations and safeguards. Check that it names each provider, what it does and where, and that there is a way to be told about changes.
- A statement of what is collected and for how long. Ideally on a public page, not only in a sales call.
- How deletion and export work. Deleting your data when you leave is a requirement in practice, not a courtesy.
- Who to contact. A named contact for privacy questions, and an address for the vendor.
If a vendor does not have these ready, that tells you how the relationship will go.
Choosing by situation
Which items weigh most depends on who you are:
| You are | Weigh most | Why |
|---|---|---|
| A small business with a public website | Cookies, IP storage, DPA available | You want to avoid a consent banner and keep paperwork light |
| An agency or consultancy | Subprocessor list, DPA, deletion | You are the processor for your clients and need to pass the chain on |
| A company with a data protection officer | Written answers to the full checklist | The officer will ask for evidence, not marketing |
| A public-sector or regulated organization | Processing locations and transfer safeguards | Stricter rules may apply, and you need advice for your case |
For broader comparisons of tools, see privacy-first Google Analytics alternatives. For the link side of the same question, GDPR-compliant URL shortener: what to check applies this checklist to link tools, and privacy-first analytics shows how useClick approaches it.
Frequently asked questions
Does EU hosting make an analytics tool GDPR compliant?
No. Hosting location is one factor. Compliance depends on what is collected, why, under which legal basis, with which processors and safeguards, and on how you use the tool. EU hosting can make some questions easier, and it does not answer them.
What is the difference between data storage and data processing?
Storage is where data rests, typically a database region. Processing is everything done to the data, including the servers, networks and services it passes through. A product can store data in the EU and still process some requests elsewhere.
What is a subprocessor?
A subprocessor is a company that your vendor uses to help process your data, such as a hosting provider, a network provider or an email service. Your data processing agreement should list them and say what happens when they change.
Do I need a data processing agreement with an analytics vendor?
If the vendor processes personal data on your behalf, Article 28 GDPR requires a contract that covers certain points. Whether your use involves personal data depends on the tool and your setup, so check with your data protection contact.
Is a US company always a problem?
Not automatically. The GDPR allows transfers outside the EU under specific safeguards, such as an adequacy decision or standard contractual clauses. The question is whether the vendor identifies the safeguard for each provider and whether you accept it for your use case.
Should I prefer a tool that does not store IP addresses?
It reduces the amount of personal data involved, which usually simplifies your obligations. It does not remove them, and you should still check the other points on the list.
Where do I find useClick's information?
The privacy policy, the subprocessor list and the data processing addendum are public. Read them as you would read any other vendor's, with the checklist above.
The decision in one paragraph
Treat "hosted in the EU" as the start of a question, not the answer. Ask where the data is stored and where requests are processed, get the subprocessor list with safeguards, find out what the tool collects and keeps, and read the data processing agreement before you sign. Prefer vendors that state their limits plainly over those that promise there are none, and talk to your data protection contact for the parts that depend on your situation.
