GDPR data residency for SaaS companies: what actually matters

“Is the data in the EU?” is the question procurement sends. It is the wrong first question. GDPR cares about who can instruct the processor, what leaves the EEA and how long you keep it. A Dublin VM with a US admin laptop and an uncleared support vendor is not a residency story. It is a transfer story.

Three words that get collapsed

• Residency. The disk and the running process sit in a named jurisdiction. This is what a data centre choice actually buys.
• Transfer. A copy, a replica, a log ship or a support session that leaves that jurisdiction. SCCs and a transfer register live here, not in the colo contract.
• Access. Who can decrypt or instruct. IAM, break-glass and your DPA with the hoster.

Picking Istanbul or Dublin without locking admin access and backup targets is theatre. See GDPR and KVKK for the legal pages; this article is the infrastructure cut.

What to put in the architecture note

A one-page note that survives a customer questionnaire:

1. Primary region and whether replicas may leave it.
2. Backup site (off-site is required; “same rack” is not residency).
3. Who holds the hypervisor and disk encryption keys.
4. Support path: do foreign staff get a jump host.
5. Sub-processors that touch production (email, error tracking, payment).

If you cannot fill (3) and (4), the region pin on a map is decoration.

How we host it

Zenix operates AS209604 with PoPs in Istanbul, Sofia, Dublin and Karachi. Istanbul is owned and operated by us; the other sites are carrier-neutral facilities on the same ASN. Compute SKUs (dedicated, public cloud) and colocation can be pinned to a facility on the order. Backups, if you buy them from us, land in a different Zenix site — that is a transfer you should list.

We will not sign a statement that “no US person can ever see the data” if your own staff use a SaaS laptop. We will sign where the servers sit and how our staff reach them.

Residency is a placement decision. Transfer and access are process decisions. Buy the first from a data centre. Write the other two before the enterprise security questionnaire arrives.