UK + EU data residency for solo founders — the SaaS-buyer's quick checklist
What 'EU residency' actually means in 2026, why it's not the same as 'EU-friendly', and the 8 questions to ask any SaaS before signing a UK-based contract.
UK data residency requirements have been quietly tightening since the Brexit-era GDPR transitional period ended. EU-AI-Act compliance (in force August 2025) added another layer. For a UK solo founder picking SaaS tools in 2026, “hosted in the EU” isn't enough — and most US-hosted AI tools still aren't making it easy to comply.
What ‘residency’ actually means
Three distinct things often get bundled under the “data residency” umbrella:
- Storage residency — where the bytes physically sit. Easy to ask, easy to verify.
- Processing residency — where the compute runs. Harder to verify if the vendor uses CDN edges or burst-to-US during traffic spikes. Worth asking explicitly.
- Sub-processor residency — third-party services your vendor uses. A vendor hosted in Frankfurt but using a US-based AI API is shipping your data to the US regardless of where their app servers are. You need the list of sub-processors.
The 8 questions to ask
- Where (specifically) are user records stored? (Country + region.)
- Where is AI inference run? (Same answer might not apply.)
- What sub-processors handle my data? (List, with URLs.)
- Are uploads transferred to the US for any reason — even temporarily?
- What's the data-retention default? Can I change it?
- Is the DPA standard contractual clause-compliant for UK + EU exports?
- Is there a customer-controlled deletion API or button?
- Where is the company entity registered? (For dispute jurisdiction.)
How Apexkit answers these
- Storage: Supabase EU (Ireland) + Cloudflare R2 EU.
- AI processing: OpenAI's EU residency programme + Anthropic EU (Frankfurt) where supported; Replicate's EU region where supported. The small minority of models without EU residency are flagged in the tool UI.
- Sub-processors: published on the privacy page — /privacy.
- Retention: 24h on Free, 7d on paid, configurable. One-click full deletion.
- DPA: standard contractual clauses, sign-on-self-service for any tier.
- Entity: Apexkit Ltd, UK company, English law jurisdiction.
The honest gap
A small number of specialist models still require US-routed inference for now — GPT-4o-realtime audio, parts of the Flux LoRA training pipeline. We surface these in-tool with a banner so you can decide whether to use them. They cover maybe 5% of overall usage; the other 95% never leaves the EU.