What EU data residency actually covers.

Somebody in procurement asks where the customer data is stored, and the answer comes back: Frankfurt. Everyone relaxes. The box gets ticked, the contract gets signed, and nobody reads the second page of the hosting policy — which is where the vendor lists, honestly and in some detail, the eight circumstances under which your data goes somewhere else. Data residency is a fact about a disk. The thing procurement was actually asking about is jurisdiction, and those are not the same question.

Is EU data residency the same as GDPR compliance?

No. EU data residency means your records are stored at rest in an EU data centre. GDPR compliance is a much broader obligation covering lawful basis, purpose limitation, data-subject rights, processor contracts under Article 28, and — separately — international transfers under Chapter V. A vendor can host you in Frankfurt and still transfer personal data to the United States lawfully, using Standard Contractual Clauses or the EU-US Data Privacy Framework. Residency narrows the transfer question. It does not close it.

What does "EU data hosting" actually cover at HubSpot, Zendesk, and Intercom?

Less than the phrase suggests, and all three say so in writing. HubSpot lists eight documented cases where customer data is processed outside your data centre location, including access by HubSpot affiliates in the USA, usage analytics transferred to the United States, and support engineers reading your account from another region. Zendesk reserves the right to process Service Data through "any member of the Zendesk Group" in other territories. Intercom sends your billing details, workspace admin data, usage metadata, and infrastructure telemetry out of the EU by design.

None of this is a scandal, and none of these vendors are hiding it. It is what running a global SaaS product requires: someone has to be able to debug your account at 03:00, and that someone is wherever they are. The point is narrower and more useful. The commitment you are buying is storage location for a defined subset of data, with a documented exception list — not a promise that your customer records stay inside one legal boundary.

Read the exception list before the marketing page. HubSpot's hosting FAQ, Zendesk's Regional Data Hosting Policy, and Intercom's Regional Data Hosting article are all public, all specific, and all more informative than any comparison chart including this one.

• Support and engineering accessStaff outside your region may read your data to fix a bug or investigate a security incident. HubSpot documents this explicitly; Intercom says in-region teams handle the majority of cases and that you are notified before an out-of-region exception. This is the exception that fires most often.
• Billing and account dataIntercom processes your name, email, and card details in the US because billing happens there. HubSpot treats analytics and usage data the same way. Your customers' records may stay put; your own do not.
• Sub-processorsEvery vendor has a sub-processor list, and each entry has its own locations. HubSpot publishes a column per data-centre region so you can see which sub-processors process where, and marks the optional ones with an asterisk.
• Integrations and marketplace appsOnce data leaves for a third-party app, the residency commitment stops applying. Zendesk states this for Non-Zendesk Services; Intercom states it for anything flowing to Facebook, Salesforce, and the rest. This is the one buyers forget.
• Your own users travellingHubSpot notes that if your staff log in from another region, data moves with them, and that managing this is your responsibility, not theirs.

Which plans do you have to buy to get EU data residency?

Higher ones than you would expect, because residency is packaged as an upsell. At Intercom, Regional Data Hosting is available only on the Advanced and Expert plans, only through sales, and explicitly not through the Early Stage programme — so the Essential plan, where most small teams land, cannot get EU hosting at all. At Zendesk, the Data Center Location add-on is free from Suite Professional upward, currently $115 per agent per month, but it is not activated by default: Zendesk states that accounts without it activated may be moved between regions without notice. At HubSpot, free accounts cannot change data centre at all — you have to upgrade to Starter or above first. Salesforce does not publish a price for the Hyperforce EU Operating Zone; it arrives through an enterprise conversation.

There is also a migration tax nobody mentions in the demo. Intercom cannot move an existing workspace between regions: you create a new workspace in the EU and manually re-create teammates, roles, workflows, inboxes, contacts, custom attributes, and outbound campaigns. Zendesk copies your data to the new region and then deletes the original under its deletion policy. If residency might ever be a requirement, it is dramatically cheaper to decide that before you have three years of history.

The pattern is the one we have written about before in a different context: the meter is attached to the wrong thing. A legal requirement about where records live is being sold per seat, per tier, and per sales conversation.

Does storing data in Frankfurt solve the CLOUD Act problem?

Not on its own. The US CLOUD Act reaches data in a US provider's possession, custody, or control regardless of where the servers sit, so a US-headquartered vendor with an EU data centre is still a US-headquartered vendor. This is not a hypothetical read of the statute. On 10 June 2025, Anton Carniaux, Microsoft France's director of public and legal affairs, told a French Senate inquiry under oath that he could not guarantee French citizens' data would never be handed to US authorities without French consent.

That testimony is worth more than any vendor FAQ, because it was given under oath by someone whose job is to reassure exactly this audience. Microsoft's position — that it refuses requests it considers unfounded, and that the situation had not yet arisen — is a reasonable one. It is also, plainly, not the same as a guarantee.

The transfer framework everyone is relying on is meanwhile still in front of a court. The EU General Court dismissed Philippe Latombe's challenge to the EU-US Data Privacy Framework on 3 September 2025, upholding the Commission's adequacy decision. Latombe appealed on 31 October 2025, and the appeal sits at the Court of Justice as Case C-703/25 P. The DPF is valid law today. It is also the third transatlantic adequacy arrangement in a row to be litigated, after Safe Harbour fell in 2015 and Privacy Shield fell in 2020. Building a compliance posture that depends on the third one holding is a position, not a plan.

How does Munin handle EU data residency?

Two ways, and the second is the point. Munin Cloud runs in the EU, so hosted customers get EU residency on the free tier rather than on the third pricing tier. And because Munin is MIT-licensed end to end, you can run the identical stack on your own hardware with docker compose up — in which case residency is not a commitment anyone makes to you, it is a property of where you put the machine.

That distinction matters more than it sounds. Every vendor above is asking you to trust a policy document that they can revise, on infrastructure they control, under a legal system they did not choose either. Self-hosting replaces the policy document with a fact. There is no enterprise/ directory holding the residency feature hostage, no plan gate, and no version of Munin you have to buy to get your data to stay where it is. We would rather you could leave — and residency is the case where being able to leave and being compliant turn out to be the same capability.

The things a data-protection officer usually asks for next are structural rather than bolted on. CRM, conversations, knowledge base, CMS, outreach, and analytics share one Postgres schema with row-level security carrying the tenant boundary, so there is one copy of a contact to export, rectify, or erase rather than six systems to chase for an Article 17 request. Consent state lives on the contact record. Every agent tool call is audited, which is the log you want when someone asks what automated processing touched a person's data. And when the answer to "can we get everything out" needs to be yes, every module exports — the same door, used in the other direction.

One more thing worth being precise about, because it is where AI and residency collide. Munin does not bundle a model. You point an MCP client at the endpoint — Claude, ChatGPT, Cursor, or your own runner — which means the question "which jurisdiction processes our customer data for AI" is answered by your choice of model provider, in your own contract with them, rather than by a metered AI feature inside the helpdesk whose sub-processor list you inherit.

EU data residency compared

Plan packaging and pricing change often — confirm on each vendor's own site, including ours. Figures above are indicative and were checked on 3 August 2026.

• 01Ask for the exception list, not the data-centre location. Every honest vendor has one in writing.
• 02Ask which plan residency requires, and whether it is activated or merely available.
• 03Ask what migrating an existing account costs — in Intercom's case, a new workspace built by hand.
• 04Check the sub-processor list per region, and which entries are optional.
• 05Ask who can read your data at 03:00 to fix an incident, and from where.
• 06Decide whether a contractual commitment or a machine you control is the guarantee you need.

Frequently asked questions

Is there a GDPR-compliant CRM that is hosted in the EU? Several. HubSpot hosts in Germany from Starter up, Zendesk offers an EEA region from Suite Professional, Salesforce has the Hyperforce EU Operating Zone, and Munin Cloud runs in the EU on every tier including the free one. Compliance itself depends on how you use the tool — but EU hosting is available from all of them, at different prices and on different plans.

Does EU data residency make a US vendor CLOUD Act proof? No. The CLOUD Act reaches data a US provider has possession, custody, or control of, wherever it is stored. In June 2025 Microsoft France told the French Senate under oath that it could not guarantee French data would never be disclosed to US authorities. Storing in Frankfurt reduces exposure; it does not remove the jurisdictional link.

Is the EU-US Data Privacy Framework still valid in 2026? Yes, as of today. The EU General Court upheld the Commission's adequacy decision on 3 September 2025, dismissing Philippe Latombe's annulment action. He appealed on 31 October 2025 and the case is pending at the Court of Justice as C-703/25 P. Two previous frameworks, Safe Harbour and Privacy Shield, were struck down in 2015 and 2020.

What is the cheapest way to get EU data residency for a CRM and helpdesk? Self-hosting something MIT-licensed, or a vendor that includes residency on the free tier. Munin does both: Cloud Free is €0/month and EU-hosted, and self-hosting is docker compose up with no licence fee, in which case the region is whichever region your server is in.

Can I self-host a GDPR-compliant CRM, helpdesk, and knowledge base together? Yes. Munin is MIT-licensed and self-hostable with Docker Compose, and puts CRM, conversations, knowledge base, CMS, outreach, and analytics on one Postgres with row-level security. One contact record means one place to satisfy an access, rectification, or erasure request.

Where does the AI processing happen if my helpdesk uses AI? With bundled AI features, wherever your vendor's model sub-processor runs — check their sub-processor list per region. Munin ships no model: you connect your own MCP client, so the model provider and its jurisdiction are your contract to negotiate and your list to audit.

Does Munin offer UK, Swiss, or Australian data residency on Cloud? Munin Cloud runs in one EU region. If you need a specific non-EU jurisdiction under a hosted contract, Zendesk and Salesforce both sell that today. If you need a specific jurisdiction at all, self-hosting Munin gives you every jurisdiction on earth, because you pick the datacentre.

If the residency requirement is real and the enterprise budget isn't, Munin Cloud is EU-hosted and free to start, or it's docker compose up from the repo on a machine in whichever country your lawyer prefers.

Residency is a postcode. Sovereignty is a licence.