AI support data residency has two halves, and most vendors only promise one. Storing your tickets in the EU is not the same as running the AI in the EU. Zendesk, Freshdesk, HubSpot and Front can all host data in Europe, but each one has exceptions for some AI features, regions or older accounts, and Help Scout and Gorgias list their AI providers as US-only.
GDPR does not require EU storage. It requires a legal basis for every transfer, and the EDPB counts remote access from the US as one. So ask every vendor three things: where the ticket is stored, where the model runs, and who can reach it from where. Expect to pay about 10% more for in-region model processing.
eesel stores EU workspaces in Ireland and can run its models on AWS Bedrock in the EU on request.
What does data residency mean for AI support?
I build integrations at eesel, and in AI support a single ticket gets copied far more often than buyers expect. It sits in your helpdesk. A copy goes into the AI tool's search index so the agent can find similar past tickets. The text is sent to a large language model to write a reply. And traces of all that land in logs and backups. Each of those stops can be in a different country.
That is why I split the question in two:
- Data residency (storage): where tickets, attachments, embeddings and backups are kept when nothing is happening.
- Processing residency (inference): where the model actually runs when it reads a ticket and writes a reply.
Vendors are usually precise about the first and vague about the second. OpenAI's own docs draw the line clearly: content is "stored at rest in the selected region", and only some regions also do inference there. Its data residency docs list Australia, Canada, Japan, India, Singapore, South Korea and the UK as storage-only regions.
This comes up on real sales calls. A Danish telematics team told us their security review was a hard gate before any trial, and their first question was whether ticket data with card numbers and passwords stays in their environment. A semiconductor-hardware evaluator wanted to know if the agent quietly "uses some kind of other ChatGPT" when it doesn't know an answer. And one Nordic HR-compliance software company put it plainly once it had what it needed:
"We needed a turnkey solution for Confluence that met our GDPR requirements and could serve different teams through dedicated Slack bots. eesel AI delivered exactly that, with EU data residency included."
Flemming Ottosen, Development Director, Simployer
If you work with the eesel CLI, an AI coding agent such as Claude Code can upload your approved help articles and macros, then ask the agent test questions before anything goes live. Connecting the helpdesk itself still needs someone with admin access to approve it.
Does GDPR actually require EU data residency?
No, and this is the part I see misread most often. Nothing in the GDPR says personal data has to be stored in the EU. What it controls is the transfer out of the EEA, in Chapter V. Article 44 says a transfer can only happen if the chapter's conditions are met.
There are two common ways to meet them for a US vendor:
- Adequacy (Article 45). The EU-US Data Privacy Framework lets data flow to US companies that have self-certified. It only covers companies on the DPF list, so check the AI vendor and its model provider.
- Standard Contractual Clauses (Article 46). The 2021 SCCs come with a built-in transfer assessment. Clause 14 asks you to weigh "the length of the processing chain" and "intended onward transfers", which describes an AI support stack well: helpdesk, then AI vendor, then model provider.
The DPF is in force in November 2026. The EU General Court upheld it in September 2025 in Latombe v Commission. An appeal to the Court of Justice (C-703/25 P) is still pending, and the two frameworks before it were struck down in Schrems I and II. That is why many EU buyers still ask for SCCs or EU hosting as a fallback.
Why "hosted in the EU" doesn't end the conversation
The line that matters most for support teams comes from the EDPB. Its Guidelines 05/2021 say remote access from a third country "is also considered to be a transfer", even when it is only "displaying personal data on a screen, for example in support situations".
So if your tickets sit in Frankfurt but the AI provider processes them in Virginia, or the vendor's US engineers can open them, that is still a transfer and still needs DPF or SCCs. EU storage shrinks the problem. It does not remove it.
If you're also working through the EU AI Act, that's a separate set of duties. I cover it in my EU AI Act guide.
What about outside the EU?
Most other privacy laws work the same way: accountability for transfers, not forced local storage. China is the main exception.
| Jurisdiction | Requires local storage? | What it actually asks for |
|---|---|---|
| EU / EEA (GDPR) | No | A transfer tool for any non-EEA access: adequacy (DPF) or SCCs plus an assessment |
| UK | No | The UK Extension to the DPF, or UK transfer tools |
| Australia (APP 8) | No | Reasonable steps, and you stay accountable for the overseas vendor |
| India (DPDP Act s.16) | No, by default | Transfers allowed unless the government restricts a country |
| Saudi Arabia (PDPL Art. 29) | No, with conditions | Adequate protection and only the minimum data needed |
| Quebec (Law 25 s.17) | No | A privacy impact assessment and a written agreement first |
| China (PIPL Art. 40) | Yes, for critical operators and high volumes | Domestic storage, plus a security assessment to send data abroad |
What can "EU processing" mean at the model layer?
When a vendor says the AI runs "in the EU", it can mean three different things. The model providers all offer the same three options under different names.
- Global. The request goes wherever there is spare capacity. Google is blunt about it: a global endpoint "may be processed in any Google Cloud location" and gives no residency guarantee.
- Geography. Processing stays inside a zone like the EU, but the provider picks the region. Azure's Data Zone and Bedrock's
eu.cross-region profiles work this way. Azure's EU zone follows the EU Data Boundary, which can include Norway and Switzerland, and Microsoft "can add regions to either data zone without prior notice". - Single region. One named region, like Frankfurt. It gives the most control, but new models arrive here last. Microsoft says geography-based deployments "have no guaranteed availability date".
Here's how the main providers line up in November 2026:
| Provider | EU option | Price vs global | Catch |
|---|---|---|---|
| OpenAI API | eu.api.openai.com, storage and inference in region | +10% on models released from 5 March 2026 | Needs approval for abuse monitoring controls and a Modified Retention amendment. Account and usage data stays out of scope |
| Azure OpenAI | EU Data Zone or a single region | +10% (GPT-6.1 Sol input $2.00 to $2.20) | Batch is a global type and may process anywhere |
| Claude API (direct) | None today: only us or global | US-only is 1.1x | Stored data is US-only |
| Claude on Bedrock or Vertex | EU regional or eu multi-region | +10% | Vertex single regions only serve Sonnet 4.6 and older |
| AWS Bedrock | eu. geographic profile | Standard price (global is about 10% cheaper) | Prompts can move between EU regions |
| Google Vertex (Gemini) | EU multi-region or a country region | +10% (Gemini 4 Argon input $2.00 to $2.20) | Search grounding logs kept up to 3 days with no off switch |
The price gap is consistent: about 10% on list price at every provider that offers it. On a support stack that's usually small next to helpdesk seats, but it's real, and it's one reason a vendor may quietly default to global routing.
For a broader comparison of these model APIs, see OpenAI vs Anthropic vs Gemini.
Which helpdesk AI keeps data in region?
I went through each vendor's own residency pages and subprocessor lists. Every helpdesk below except Help Scout can store data in Europe. Whether the AI follows depends on the vendor, the region and sometimes the date your account was created.
| Helpdesk | Storage regions | Residency on which plan | Does the AI stay in region? | Model providers named |
|---|---|---|---|---|
| Zendesk | US, EEA, UK, Japan, Australia | Free on Suite Professional and up, must be activated | Mostly. LLMs use zero retention, but voice transcription is US-only and older AI agents accounts are EEA or US only | OpenAI, Google Gemini, ElevenLabs, plus Bedrock, Azure, Groq, Fireworks, Baseten |
| Freshdesk | US, EEA, UAE, India, Australia | Picked at sign-up | Yes for US and EU by default. Some India, Australia and Middle East features use US processing | Azure OpenAI |
| HubSpot | US, EU (Germany), Canada, Australia | Any paid tier can switch | Yes for EU. Canada and Australia AI runs in the US, and AI web search is US for every region | OpenAI, Google, AWS, Baseten |
| Front | US or EEA | Ask your account rep | Partly. Azure, AWS and Google AI can run in the EU; direct OpenAI is listed as US | OpenAI, Azure OpenAI, Mistral on AWS |
| Gorgias | US, EU, Australia (by location) | Assigned automatically | Not stated. OpenAI and Anthropic are listed as US subprocessors | OpenAI, Anthropic, in-house models |
| Help Scout | US only | No option | No | OpenAI, plus Anthropic and Google listed |
| Salesforce | 18 Hyperforce countries | EU Operating Zone is a paid add-on | Routes to the nearest region, but falls back to other regions by default | OpenAI / Azure, Claude on Bedrock, Gemini, Amazon Nova |
Pick your helpdesk below to see the catch that matters most for it.
Where does my helpdesk's AI actually run?
Pick the helpdesk you're on. Facts come from each vendor's own residency and subprocessor pages, checked November 2026.
The catch: the location add-on is not switched on automatically, AI agents accounts made before 10 March 2026 only support EEA (Belgium) or US hosting, and real-time voice transcription runs in the US. Ask: "Is the add-on active on our account, and which AI features fall outside it?"
The catch: for India, Australia and Middle East accounts, some Freddy features process in the US, and those features are off by default. Opting out of model training is an email to support. Ask: "Which Freddy features are off for our region, and have we opted out of training?"
The catch: Canada and Australia data centers send AI processing to the US, and the web search tools behind HubSpot AI run in the US for every region, the EU included. Ask: "Can we turn off AI web search for our account?"
The catch: Azure, AWS and Google AI can run in the EU for EEA accounts, but direct OpenAI is listed as US, and Front doesn't say which features use which. Backups and logs may be processed outside the US and EEA. Ask: "Which AI features call OpenAI directly for an EEA account?"
The catch: the subprocessor list shows OpenAI and Anthropic in the United States only, and Gorgias says AI Agent learns from interactions across brands, with safeguards. Ask: "Where do AI Agent model calls run for an EU-hosted store?"
The catch: there is no regional hosting, and AI Assist data may be stored by OpenAI for up to 30 days. EU teams rely on transfer tools, not residency. Ask: "Which transfer mechanism covers our data and your AI providers?"
The catch: if a request fails in your region, it re-routes to another region by default. You have to switch on in-region-only requests, and the OpenAI route can fall back to Azure in the US. Ask: "Is region fallback switched off on our org?"
Zendesk: free, but you have to switch it on
Zendesk's Data Center Location add-on is "free of charge for Zendesk Suite Professional or higher plans, but it is not automatically activated". Until it is, Zendesk says it may move account data "between regions without notice". On the AI side, Zendesk says model providers keep nothing: "all processing occurs with zero data retention", and it was "one of the first companies to access OpenAI's European endpoints".
The exceptions are in the regional hosting policy: AI agents accounts created before 10 March 2026 only support EEA (Belgium) or US hosting, and Forethought AI Agents aren't covered. More on this in my look at Zendesk AI data privacy.
Freshdesk: in region by default, with region-specific exceptions
Freshworks says Freddy AI Copilot data is "processed and stored within your local data centers" by default, and that features needing out-of-region processing are disabled by default. The exceptions are India, Australia and Middle East accounts. If you're weighing Freddy AI for an EU team, residency is one of its stronger points, since Freddy runs on Azure OpenAI.
HubSpot: the clearest table of the lot
HubSpot publishes a column per data center showing where each AI provider processes data. For EU accounts, OpenAI runs in the "European Economic Area and Switzerland". For Canada and Australia, it's the United States.
The web search tools that HubSpot AI uses (Bright Data and Exa) run in the US for every data center, according to its subprocessor page. If that matters, check whether you can switch AI web search off. My HubSpot Service Hub AI alternatives post covers the rest of the AI stack.
Help Scout and Gorgias: no in-region AI promise
Help Scout is hosted "on AWS servers in the United States", with no EU option, and AI Assist data "will be stored by OpenAI for up to 30 days". Gorgias hosts EU stores in the EU, but lists its AI providers as US-only. That doesn't rule them out for EU teams. They rely on transfer tools rather than residency. If residency is a hard requirement, see Help Scout AI alternatives or Gorgias AI Agent pricing for what the upgrade path costs.
What gaps do vendors leave out of the headline?
The residency page usually covers ticket storage. These are the pieces that tend to sit outside it, all taken from the vendors' own fine print:
- Fallback routing. Salesforce re-routes a failed request "to another region to avoid returning an error" unless you switch on in-region-only requests. That's a sensible default for uptime, and a surprise for a residency audit.
- System and account data. OpenAI says residency "does not apply to system data", which covers metadata, usage and billing.
- Logs and backups. Front's policy says backups and logs "may be otherwise processed outside of the EEA and the US".
- Add-on features. Zendesk voice transcription is US-only, HubSpot's AI web search is US-only, and Google keeps search grounding logs for up to three days.
- Account age. Zendesk AI agents and Salesforce generative AI both treat older accounts differently from new ones.
None of these is hidden. They're just not on the sales slide. The AI support vendor security checklist has a wider list, and PII redaction shrinks what's exposed if something does leave the region.
What should you ask an AI support vendor?
Send these before the demo, not after. They take five minutes to answer for a vendor that knows its own stack.
- Where are tickets, attachments and the search index stored? Ask for the region, not "the EU".
- Where does the model run, and which provider runs it? Ask whether it's global, a geography or a single region.
- Can a request fall back to another region? If yes, ask how to switch that off.
- Which features are excluded? Voice, web search, analytics and quality scoring are the usual ones.
- Where do logs and backups go, and for how long?
- Who can access the data from outside the region? Under the EDPB guidance, support engineers count.
- Is the model trained on our tickets? Get "no" in the DPA, not on a blog.
If you're running a formal process, my AI support RFP template turns these into scored questions, and running a security review covers who owns each step.
For heavily regulated teams, AI for regulated industries and HIPAA-compliant AI go further.
How does eesel handle data residency?
I'd rather show you eesel's own setup with the same honesty I applied to everyone else, so here it is from our trust center and subprocessor list:
- Default: production runs on AWS in the US (N. Virginia).
- EU workspaces: stored on AWS in Ireland, with the search index in the EU on Pinecone. The pricing page lists "EU or US data residency" on the Free and Teammate plans.
- AI processing in the EU: by default, model calls go to the providers on the subprocessor list, which are US-based. To keep AI processing in the EU, the Bedrock option runs every model call on AWS Bedrock in eesel's own AWS account, in EU regions on request. It's the same setup our HIPAA workspaces use, and tools like web search that would send content elsewhere are turned off.
- What still sits outside: agent sandboxes are hosted by Vercel in the US, even on the Bedrock option. That's on the subprocessor page, and I'd rather you read it here first.
- Training and retention: eesel doesn't train or fine-tune models on your data. Backups are encrypted and roll off within 35 days of deleting a workspace.
A lot of our customers are European teams answering in their own language. smava in Berlin handles about 27,000 Zendesk loan tickets a month, sorted and drafted in German. Timengo, which makes secure email software in Denmark, drafts Danish replies from about 5,300 past tickets and articles. Dokument 24 gets a Danish draft and a product tag on every new Zendesk ticket.
If you're comparing tools for that kind of team, best AI for multilingual support is a good next read.
eesel's SOC 2 Type II audit is in progress, with the observation period running through 31 December 2026. If a finished report is a hard requirement today, that's a fair reason to wait for it.
Try eesel on an EU workspace
If your team supports European customers and needs the AI to stay in Europe too, eesel is an AI helpdesk teammate that joins your existing Zendesk, Freshdesk or Gorgias queue and drafts replies from your past tickets and help center.
Set the workspace up in the EU, ask for EU model processing on the Bedrock option, and run a simulation on your own resolved tickets before anyone signs a DPA. You get our full subprocessor list with locations up front, so your privacy team can check every stop on the map. The Teammate plan starts at $299 a month for 500 credits, and the enterprise plan adds custom data residency and a BAA. Try eesel.