AI hosting in Europe: where your data sits and who controls it

A data centre in Frankfurt does not make a provider European. Of the 20 providers we cover, 12 can keep your data in at least one EU country. Only six of those 12 are EU companies. Five are American. The twelfth is Kamatera, whose terms name only Kamatera Inc., the company that serves its US customers.

Where your data sits, its data residency, depends on the data centre you choose. Who holds it depends on the company named in your contract, and that company is also bound by the laws of its home country. The tables below set out these facts separately for every provider we cover, together with its data terms. We read all of them on the providers' own pages on 25 October 2026.

Three questions to ask any host: who, where and on what terms

Most hosting sales pages we read answer only the second question. Ask all three, in this order, and write the answers down for your own records.

Which company are you dealing with?

The company that matters is the one named in the provider's terms of service or legal notice, not the brand on the home page. Hostinger is a good example. Its terms name Hostinger International Limited, in Larnaca, Cyprus, as the company for EU customers. Yet its about page says the business is headquartered in Vilnius, Lithuania.

Where does the data sit?

This is the data centre you pick when you order. Most of the server hosts we cover let you choose a city. Some managed services name no region at all, and then you cannot check where your data is.

What does the contract say?

Under the EU's General Data Protection Regulation (GDPR), you need a written contract with any host that handles personal data for you. The law sets out what it must contain, and it is usually called a data-processing agreement (DPA). Check that one exists, that it lets you choose the data centre and that it says how transfers outside the EU are handled.

The 20 providers at a glance: company, data centres and contract

This table answers the three questions for every provider we cover. We took each company from the provider's terms, legal notice, privacy policy or about page, and the countries from its own location and order pages. The last column shows whether the provider offers a data-processing agreement.

The UK, Norway and Switzerland appear under "elsewhere" because they are not EU countries. Norway belongs to the European Economic Area, so the GDPR applies there. The EU also recognises the UK and Switzerland as giving adequate protection, which we explain in the GDPR section below.

Servers for n8n and AI agents in Europe: five EU companies to choose from

An agent server stores everything the app keeps: workflows, credentials, logs and the data that passes through it. On a server you run yourself, your prompts and files stay on the machine unless your agent sends them to a model API. Then that API's terms apply as well; the prompts table further down covers them.

In the price boxes, a price without a VAT note excludes VAT, as the provider's page states. "VAT not stated" means the page does not say.

Two managed services are not in the table. Cloudways says you can choose a region for its managed AI agents, such as OpenClaw, but none of the pages we read names one. ScalaHosting lists data centres in 10 EU countries, yet none of its pages that we read ties its managed n8n plan to any of them.

If you want a European company in place of DigitalOcean, look at UpCloud, which is based in Finland. Like DigitalOcean, it bills for as long as a server exists, up to a monthly cap (UpCloud by the hour, DigitalOcean by the second). It also rents out GPU servers. Its Starter plan above comes in seven EU locations.

Our other guides compare these servers on speed and cost rather than on where the data sits. Start with our guides to hosting an AI agent that runs 24/7 and the main ways to run n8n. For the servers themselves, see the best virtual private server (VPS) for n8n.

GPU servers in Europe: fewer choices, and two clouds that name no country

For GPUs, the same three questions apply, but fewer plans sit in EU data centres. In our records, three providers have GPU plans in the EU. UpCloud has them in Helsinki, Unihost in Amsterdam, Frankfurt and Poland (Warsaw or Gdańsk), and DigitalOcean in Amsterdam. On all of these, the model runs on the machine you rent, so prompts and files stay there unless your own software sends them elsewhere.

Monthly costs for hourly prices assume the server runs all month (730 hours), or less where a provider caps the monthly bill.

Runpod and Vast.ai are not in the table because neither names the country of a European data centre on the pages we read. Runpod's documentation identifies its data centres by codes, such as EU-CZ-1 and EU-RO-1. Its security page says it complies with the GDPR for data processed in its European regions, without saying which countries those are. Vast.ai is a marketplace whose pricing page says the market sets prices across more than 40 data centres. Its privacy policy names the United States as a place where it may store your information.

GPU Mart and Liquid Web keep their GPU servers in the US only. GPU Mart's privacy policy also says it offers no data-processing agreement and makes no claim to follow non-US rules such as the GDPR.

To compare GPU servers on price and speed, see our guides to renting a GPU by the hour and dedicated GPU servers by the month. For the bigger picture, see our guide on where to run an open-source LLM (large language model).

Document chatbots: both services we cover are run by US companies

A document chatbot keeps your files, your visitors' questions and its answers. Neither of the two chatbot services we cover lets you choose EU storage on its standard plans.

CustomGPT.ai is run by its own US company, not by OpenAI, although its security page says the service is built on OpenAI's API. Its GDPR page says it cannot keep your data inside the EU for now. Its pages also disagree about the data-processing agreement. The security page offers a DPA to Enterprise customers only, while the GDPR page says every customer gets one.

DocsBot AI lists US and EU storage options, but its plan table offers them only on Enterprise, at a custom price. Its list of subprocessors (the outside companies that handle data for it) shows document data stored in Frankfurt. The same list shows US companies running the hosting and the main AI models, and its privacy policy says data passes through OpenAI's APIs.

Two other guides go further. Our comparison of chatbots for your website looks at the services themselves. Our guide to choosing between fine-tuning and a document chatbot compares the two routes.

Model APIs (hosted LLMs) in Europe: one Swiss option among the providers we cover

When an AI step calls a model API, the prompt leaves your server. The API's location and terms then matter as much as the server's. None of the model APIs we cover states that it runs in an EU country. Here is what each one says:

• Infomaniak runs its AI Services in its own data centres in Switzerland and says it neither records your queries nor uses them to train models
• DigitalOcean says on its models page that it does not offer EU data residency at present
• Novita AI names no data-centre country; its privacy policy says its users' personal information may be sent to other countries, the US included

On Infomaniak, Apertus-v1.5-70B costs €0.70 in / €2.50 out per million tokens (checked 25 October 2026), and Mistral-Small-4-119B-2603 costs €0.20 in / €0.75 out per million tokens (checked 25 October 2026). To keep prompts inside the EU itself, run an open model yourself, for example on one of the EU GPU servers above.

Do AI services keep your prompts and files, or train on them?

All seven covered services that state a training policy say they do not train on your prompts or files; Novita AI adds "by default". Four of them keep your content for some time. The table shows what each covered model API, chatbot, image tool and managed agent service says on its own pages. "Keeps" means the service stores your prompts, files or results; "trains" means it uses them to train AI models.

Two details stand out. DocsBot AI's privacy policy lets its staff review data for support and quality checks. n8n's terms rule out training on your content. They still allow your prompts, combined with others and with identifying details removed, to help improve n8n's AI services. If either point matters to your clients, put it in your privacy notice.

n8n and the GDPR: keeping workflows and AI steps inside the EU

n8n can run entirely inside the EU. Three parts need attention: the server, the usage data (telemetry) the server sends to n8n, and the model each AI step calls.

On n8n Cloud

n8n GmbH is a German company, and its pricing page says n8n Cloud stores data on servers in Frankfurt. Its security page adds that n8n Cloud runs on Microsoft Azure, which is a US company's cloud. For n8n Cloud, n8n's privacy page says n8n acts as both controller and processor (GDPR roles, explained below). Its data-processing agreement includes the EU's standard contractual clauses. The Starter plan costs €20 a month (checked 25 October 2026), paid yearly in advance.

On n8n Cloud, n8n's privacy documentation says you cannot currently switch off telemetry. The AI Assistant is on by default there, and it can send workflow details such as node settings and code to AI services. According to n8n, those services do not train their models on that data.

On your own server

A self-hosted n8n server sends usage data to n8n by default. It reports events as they happen, plus execution counts every 6 hours. The company says this never includes the data flowing through your workflows or your credentials. To stop the server contacting n8n, n8n's documentation gives these environment variables:

N8N_DIAGNOSTICS_ENABLED=false
N8N_VERSION_NOTIFICATIONS_ENABLED=false
N8N_TEMPLATES_ENABLED=false
EXTERNAL_FRONTEND_HOOKS_URLS=
N8N_DIAGNOSTICS_CONFIG_FRONTEND=
N8N_DIAGNOSTICS_CONFIG_BACKEND=

The first three switch off diagnostics, update notices and the template library; the last three are left empty. With update notices off, watch n8n's release notes yourself. According to n8n's privacy page, a server on a paid licence still reports usage counts and its licence identifier.

The same page suggests EXECUTIONS_DATA_MAX_AGE, a setting that deletes old execution data on a schedule. When you host n8n yourself, n8n GmbH is neither controller nor processor of your data, so deleting it is your job. Our guide to securing a self-hosted n8n server covers the rest of the set-up.

For the AI steps

An EU server does not help much if every AI step sends its prompt to a model hosted elsewhere. You have three ways to keep the prompts in Europe:

• a small model on the same EU server
• a model on a GPU server in an EU data centre, from the GPU table above
• a model API that runs in Europe: of those we cover, only Infomaniak's, in Switzerland, which the EU recognises as giving adequate protection

What the GDPR asks of you, in plain words

This section is general information from the official texts, not legal advice. George runs this site from Cyprus, an EU country, so these are the rules he works under as well.

When the GDPR applies

The GDPR applies to organisations based in the EU, Iceland, Liechtenstein or Norway, which together form the European Economic Area (EEA). It also covers organisations outside the EEA that offer goods or services, paid or free, to people there, or monitor how they behave (Article 3). Such an organisation must usually name a representative in the EU (Article 27). Hosting.com's privacy policy, for example, names a company in Cologne in that role.

Your role, and the host's

When you put customer data on a server or into a chatbot, you are usually the controller in GDPR terms. You decide why the data is used, and how. The host, although it runs the machines, is the processor: it handles the data on your behalf (Article 4). You may use only processors that give sufficient guarantees of safe, lawful handling, and only under a written contract (Article 28). Among other things, that contract must say that the processor:

• acts only on your documented instructions, including on transfers outside the EU
• keeps the people who handle the data bound to confidentiality
• protects the data with suitable security measures
• deletes or returns the data when the service ends, as you choose
• gives you what you need to check all this, audits included

Sending data outside the EEA

Personal data may leave the EEA in two main cases (Articles 44 to 46). Either the EU has formally decided that the receiving country protects personal data adequately (an adequacy decision), or safeguards are in place. One such safeguard is the EU's standard contractual clauses, model contract terms that the EU has approved. The EU's list of adequate countries includes the United Kingdom and Switzerland. It also includes the United States, but only for companies that take part in the EU-US Data Privacy Framework.

US companies join that framework by self-certifying to the US Department of Commerce. You can search the participants on the framework's official list. DigitalOcean's DPA, for example, relies on the framework first and falls back on standard contractual clauses if that route stops working.

Telling people where their data goes

Your privacy notice must say who receives the data, or at least what kind of recipient (Article 13). It must also say whether the data leaves the EEA, and on what basis. If your chatbot keeps files in the US, that belongs in the notice. The GDPR also asks you to keep only the data you need, for no longer than you need it (Article 5). Deleting old n8n execution data on a schedule is one practical way to do that.

If you are in the UK or Switzerland

The UK has its own version, the UK GDPR, overseen by the Information Commissioner's Office (ICO). Its transfer rules work in a similar way. Data leaving the UK needs UK adequacy regulations, a safeguard such as the ICO's transfer agreement, or an exception. The ICO's guide on this was last updated on 15 January 2026.

Switzerland has its own Federal Data Protection Act. Its regulator, the Federal Data Protection and Information Commissioner, says the act applies directly to processing that uses AI. Infomaniak, the Swiss provider we cover, stores customer data only in Switzerland, which the EU recognises as giving adequate protection.

How we checked

On 25 October 2026 we read the pages of each provider we cover on its own website. The company came from the terms of service, legal notice, privacy policy or about page, and the data centres from location and order pages. The data terms came from privacy policies, data-processing agreements and AI terms. In a second, separate check, we read every fact again the same day.

Anything that second check could not confirm is left out or marked as unknown. Examples are Novita AI's company name and the countries behind Runpod's data-centre codes. The GDPR facts come from the regulation's text on EUR-Lex, the EU's official website for its laws, and from the EU's own pages on transfers. We also used the guide for small businesses from the European Data Protection Board (EDPB). The n8n settings come from n8n's own documentation.

Prices come from our weekly price checks and show their own dates. We plan to read these pages again every three months, and sooner when a provider changes its terms.