Solution · By task

Data in the EU

“Where exactly do you keep our data?” now turns up in supplier questionnaires from large clients, in tender specifications and at board meetings, and “in the cloud” no longer counts as an answer. We show in plain terms which systems process data inside the European Economic Area and which outside it, and where it makes sense, we move them to EU data centres. Whether a particular transfer is acceptable is for your lawyer or DPO to decide; we hand them reliable technical facts to work from.

Order a data flow map What is included

EEA

the 27 EU states plus Iceland, Liechtenstein and Norway

SCCs

standard contractual clauses in vendor terms

100 %

flow map and migration done remotely

after 18:00

cut-over scheduled outside office hours

What the solution is made of

Six stages, from inventory to ongoing care. The surprises rarely hide in the core system; they sit in the add-ons, plugins, marketing tools and backup jobs around it.

Send an enquiry

Data flow map

We list each system and SaaS subscription, the region it runs in, its sub-processors and where the vendor’s support staff connect from. Website scripts get the same treatment: chat widgets, analytics, advertising pixels.

A brief for your lawyer

For each transfer outside the EEA we note what the vendor relies on: standard contractual clauses, certification under the EU-US Data Privacy Framework or some other mechanism. Judging whether that is enough is left to your DPO or legal adviser.

Microsoft 365 and Google Workspace

We confirm the tenant’s location, which data residency options your licence actually unlocks, and which features, such as add-ins or built-in AI services, may process content somewhere else.

Hosting in EU data centres

VPS, dedicated servers or S3 storage in Poland or elsewhere in the Union, sized for the workload and for what your clients demand, with an eye on where the provider’s parent company is registered.

Backups kept in the EEA

A typical pattern: production runs in Poland while backups flow to a bucket in a US region, simply because that was the default. We relocate the copies to the EU, turn on encryption and prove that a restore works.

Migration and aftercare

Data, settings and integrations move to a written plan with a dress rehearsal and a way back. After the cut-over, for an agreed period, we keep a closer eye on the new environment and bring the documentation up to date.

The move, stage by stage

Not everything has to move. Sometimes a region setting is all it takes, sometimes one tool gets swapped, and sometimes you stay with the vendor and document the reasons properly.

Inventory

You get a list of systems, regions, sub-processors and dependencies. Your lawyer uses it to decide what stays and what moves.

Target environment

We build the new EU infrastructure, copy the data across and test it with a handful of users. Problems surface during the rehearsal rather than on a Monday morning.

Cut-over

Evenings or weekends, one system at a time. The old setup stays switched on until you confirm everything behaves as it should.

Tidy-up

We cancel the old services so you are not billed twice, have the data deleted at the previous provider and hand over a refreshed data flow map.

Data tends to leave the EU through side doors. A contact form relays messages via an overseas mail service, the shop loads a chat widget run from outside Europe, and the e-signature tool archives signed contracts in a different region from the document itself. That is why the map comes before any choice of data centre.

Questions and answers

Not outright. A transfer beyond the EEA needs a suitable basis, and whether yours has one is a question for a lawyer or DPO. In real life the “EU only” requirement more often comes from a client, a public buyer’s tender or a board that would rather not revisit the topic every year. We show what it means technically and what a change would cost.

That one belongs to your lawyer rather than your IT team. What we can do is check that the certification really covers the entity you signed with, which data reaches it, and whether settings can narrow that down. Similar frameworks have been challenged before, so some firms prefer to have an EU option ready just in case.

It depends on how many systems you run and how they connect, so we give an indicative schedule after the inventory and fix the dates in the contract. Copying the data is the quick part. Most of the time goes on integrations, for instance a shop wired to BaseLinker and a courier platform, and on agreeing a cut-over date.

A backup holds the same information as the live system, so the same rules usually apply to it. Even so, it is the part people forget: production sits in Poland while the backup has been crossing the Atlantic for years. The flow map also checks where copies are stored, how they are encrypted and who holds the keys.

You have three routes: run an open source alternative on a server in the EU, split the data so only anonymised records reach the overseas service, or keep the tool with a documented transfer basis. The right choice depends on cost and on the legal view your DPO prepares.

Services behind this solution

All services

Area 06 Cloud and hosting Servers in data centres within the EU Area 06 S3-compatible object storage Archives and files in a European region Area 12 System and database migration A move with a rehearsal and a way back Area 07 Cloud backup Encrypted copies stored inside the EU Solution GDPR compliance The technical side of data protection

Where is your data right now?

List the systems and services your company uses and, if you know, where they are hosted. We reply within one working day with a proposed data flow map and its price.

Email
office@apply.pl

Hours
Mon-Fri 8:00-18:00 CET, reply within one working day

Meetings
Online via Teams or Google Meet

Apply can process my details to handle this enquiry (see our privacy notice)