Table of Contents

• The short answer

• Stored vs processed: the gap most vendors leave open

• 10 questions to ask any AI support vendor

• How Fini AI answers them

• US vs EU: what usually decides it

• Frequently Asked Questions

The short answer

Ask every AI support vendor three things first: where customer data is stored, where it is processed (including by LLM subprocessors), and whether that is written into the DPA. "Hosted in the US" or "hosted in the EU" means little if prompts are processed elsewhere. Fini AI stores and processes customer data in the region you designate, US or EU, on Google Cloud. Fini AI can also run in your own Azure tenant and region through Microsoft Marketplace.

Need to confirm residency for your procurement review? Book a demo.

Stored vs processed: the gap most vendors leave open

Data residency has two halves:

• Storage: where conversation logs, tickets, attachments and knowledge sit at rest.

• Processing: where the model reads prompts and writes replies, and where any LLM subprocessor runs.

A vendor can store data in Frankfurt and still send each prompt to a model endpoint in another region. For GDPR, that is a transfer that needs its own safeguards. Ask about both halves, in writing.

10 questions to ask any AI support vendor

1. Which regions can we choose for storage, and is processing kept in the same region?

2. Which LLM subprocessors see our data, and in which regions do they run?

3. Is the region written into the DPA or order form, not only the website?

4. Which transfer mechanism covers any data that leaves the region (for example EU Standard Contractual Clauses)?

5. How much notice do we get before subprocessors change?

6. What is the breach notification window?

7. Is our data used to train any model, yours or a subprocessor's?

8. Who sets the retention period, and what happens to our data when the contract ends?

9. Which IP addresses will call our APIs, so we can allowlist them?

10. Which certifications cover the hosting you are offering us?

How Fini AI answers them

The contract terms are in the Data Processing Addendum and the Data Protection Policy.

How Fini AI does this: customer data stays in the US or EU region you designate, under a DPA with SCCs, a 72-hour breach notice and no model training on your data. See Fini AI for compliance teams.

US vs EU: what usually decides it

• Where your customers are. EU customers' data in the EU keeps GDPR transfer questions short.

• Where your contracts require it. Public sector, health and finance buyers often write region into procurement.

• Where your other systems run. Keeping the AI agent in the same region as your helpdesk and CRM avoids a second transfer.

• Your cloud commitments. If you have an Azure commit, a Marketplace deployment in your own tenant can count against it.

Outside the US and EU? For Canada, see our PIPEDA guide.

See how Fini AI handles data residency. Book a demo.

Frequently Asked Questions

Which AI support vendors offer data residency in the US?

Several do. Check that both storage and processing stay in the US and that the DPA says so. Fini AI stores and processes data in the US or EU region you designate, or runs in your own Azure tenant and region.

Does Fini AI offer EU data residency?

Yes. Designate the EU region and customer data is stored and processed in the EU.

Does Fini AI train AI models on our customer data?

No. Customer data is not used to train foundation models, and LLM subprocessors are contractually barred from it.

Can we host Fini AI in our own Azure tenant?

Yes. Through Microsoft Marketplace, Fini AI runs in your Azure tenant and region, and the purchase is MACC-eligible.

Why are the outbound static IPs in the Netherlands?

Actions calls come from one fixed set of four IPs in europe-west4 for every workspace, so you can allowlist a single stable set.