Global Araç
Ai Data Residency Checker
Uyumlu sağlayıcılar (7)
| Sağlayıcı | SOC 2 | HIPAA | DPA | Notlar |
|---|---|---|---|---|
| OpenAI | ✓ | ✓ | Yes (DPA available) | EU data residency requires Enterprise |
| Anthropic | ✓ | ✓ | Yes | EU data residency available; Bedrock for AWS regions |
| Google (Gemini API) | ✓ | ✓ | Yes | Vertex AI offers most regions; Gemini API less granular |
| Mistral | ✓ | − | Yes | EU-first; the default for European compliance |
| Cohere | ✓ | ✓ | Yes | Bedrock + Azure deployments cover more regions |
| AWS Bedrock | ✓ | ✓ | Yes | Most flexible regional control via AWS infrastructure |
| Azure OpenAI | ✓ | ✓ | Yes | GPT models with Azure regional control + EU Data Boundary |
Data residency requirements gate AI adoption for many enterprises and regulated industries. EU GDPR Schrems II ruling (2020) invalidated EU-US Privacy Shield, raising questions about US-hosted AI processing of EU citizen data. UK has similar concerns post-Brexit. APAC countries (Singapore, Australia, Japan) have varying data- residency rules. Healthcare (HIPAA in US, equivalent rules elsewhere), finance (SOC 2, ISO 27001, PCI DSS), and government (FedRAMP in US) require specific certifications. The checker filters AI providers by which regions they support, which certifications they hold, and which deployment options give true data residency vs theater.
Provider landscape (2024-2025): OpenAI: Enterprise plan offers EU data residency via Azure OpenAI. Standard API claims encryption-at-rest and compliance with SOC 2, but legal data flow analysis required. Anthropic: SOC 2 Type 2; offers AWS Bedrock and GCP Vertex deployment for regional residency. Google Vertex AI: most extensive regional options (EU, UK, APAC, Canada specific regions). AWS Bedrock: Anthropic, Meta, Mistral, Cohere via AWS's regional infrastructure. Azure OpenAI: enterprise-focused, EU residency, FedRAMP- approved options. Mistral: French / EU- headquartered, naturally aligned with EU residency. Cohere: SOC 2, Canadian- headquartered. Self-hosting (Llama, Mistral open-source on your infrastructure): always-compliant with any residency requirement because data never leaves your infrastructure.
Critical caveats this checker surfaces: (1) “EU region API endpoint” doesn't always guarantee EU-only data flow. Some providers route training data, logs, or backup to US even when serving inference from EU regions. Verify routing via DPAs (Data Processing Agreements) in writing. (2) Sub-processor lists matter — even compliant providers use sub-processors (CDN, monitoring, analytics) that may not be in your residency. Major providers publish sub-processor lists. (3) Logs and telemetry — many providers retain query logs for abuse-detection or model-improvement purposes; default retention may not match your residency. Negotiate zero-retention for sensitive data. (4) HIPAA covered entities require BAAs (Business Associate Agreements) — OpenAI, Anthropic, Google, Microsoft all offer for enterprise. Without BAA, you cannot use the API for PHI even if technically encrypted. (5) Self-host is the only zero-question approach for highest- sensitivity data — your infrastructure, your rules.
Nasıl Kullanılır
- Pick your data-residency region (US, EU, UK, APAC, Canada).
- Select required certifications (SOC 2, HIPAA, ISO 27001, FedRAMP, PCI DSS).
- Read filtered list of compliant providers.
- Click into providers for specific deployment options (Azure, AWS Bedrock, GCP Vertex, native).
- Verify routing claims with provider DPAs before production deployment.
Ne Zaman Kullanılır
- Enterprise AI procurement requiring data-residency review.
- Healthcare / finance / government building AI features under regulatory constraints.
- EU-headquartered companies needing GDPR-compliant AI processing.
- Multi-national rollouts requiring different residency for different markets.
- Self-host vs managed-API decision-making.
Ne Zaman Kullanılmaz
- Casual / consumer use where residency doesn't legally apply.
- Pre-procurement legal advice — this is informational; specific compliance needs lawyers.
- Latest provider certification status — provider compliance changes; verify current status with provider.
- Specific contract negotiation — DPAs and BAAs require legal team review.
Yaygın Kullanım Senaryoları
- Quick use during a typical workday
- Pre-decision sanity-check on inputs and outputs
- Educational use — demonstrating the underlying concept
- Onboarding a colleague who needs the same calculation/conversion
Sık Sorulan Sorular
Does ‘EU region’ mean data stays in EU?
Not always. EU region API endpoints serve inference from EU infrastructure, but data flow can include logging, monitoring, training, sub-processor flows that route through US. Providers vary in transparency and contractual guarantees. Always verify with provider's DPA (Data Processing Agreement) in writing. For strict residency: AWS Bedrock with EU-only sub-processors, Azure OpenAI with EU residency, or Mistral (EU-headquartered) are the most reliable.
What's a BAA?
Business Associate Agreement — required under HIPAA when a healthcare entity (covered entity) shares Protected Health Information (PHI) with a third party (business associate). Without BAA, you can't legally use the AI provider for PHI processing regardless of technical security. OpenAI, Anthropic, Google Cloud, AWS, Microsoft all offer BAAs for enterprise customers. Standard API tier typically doesn't include BAA; enterprise contract required.
What's the safest residency option?
Self-hosting open-source models on your own infrastructure. Llama 3.3, DeepSeek, Mistral open-source models all available for self-hosting. Data never leaves your infrastructure; no third-party residency questions. Trade-off: higher upfront engineering cost (model serving, monitoring, scaling), capability gap (open-source quality lags top closed-frontier by 10-30%), maintenance burden. For highest-sensitivity data, worth the investment.
FedRAMP-compliant AI?
Federal Risk and Authorization Management Program — required for US federal agency cloud usage. Azure OpenAI offers FedRAMP High authorization. AWS Bedrock approaches FedRAMP via AWS GovCloud. OpenAI direct does NOT have FedRAMP; must use through Azure. For federal agency AI work, this constrains options significantly.
What about training data?
Different from inference data. Most providers explicitly state inference-time data is NOT used for training (OpenAI default since April 2023, Anthropic always opt-out, Google with appropriate API tier). Verify in DPA. For training data (when fine-tuning custom models), residency rules may differ. Always ask about data flow specifically for training pipelines if you fine-tune.
How do I verify provider claims?
Three steps: (1) Read DPA / BAA / Master Services Agreement carefully — claims should be in contractual language not just marketing. (2) Request sub-processor list. (3) For enterprise contracts, request SOC 2 Type 2 audit reports under NDA — confirms third-party audit of stated controls. Don't take marketing claims at face value; legal language matters for compliance audits.