EEA data residency
Hosting and processing data entirely within the European Economic Area - the practical GDPR / CLOUD Act test for European digital sovereignty.
GDPR restricts transfers of personal data outside the EEA; the US CLOUD Act lets US authorities compel US-controlled companies to produce data wherever it is stored. Together they make "where does the data live, and who ultimately controls the operator" a compliance question, not a preference.
Fintechnologica flags each provider's EEA status as Yes / Partial / No - and separately shows origin and ultimate ownership, because an EEA-hosted subsidiary of a US parent still carries CLOUD Act exposure. Score your own stack at /tools/sovereignty-scorecard.
Primary source: Regulation (EU) 2016/679 (GDPR) · CJEU judgment in Case C-311/18 (Schrems II)
In the verified data
- Of 532 live providers in the catalogue, 348 keep data inside the EEA, 66 run part of their stack outside it and 118 host outside the EEA.
- 12 providers flagged EEA = Yes are nevertheless US-controlled (Aiia, Basware, CCV, Cobase and 8 more): residency answers where data lives, not who can be compelled to hand it over - who owns Europe's fintech infrastructure.
Recomputed from the catalogue and the official EBA, ESMA and FCA registers on every build — how we verify.
Questions to ask a provider
- Where are production data, backups and support access located?
- Who is the ultimate parent company, and could a non-EEA authority compel access to my data?
- Which subprocessors handle my customers' data, and in which countries?