Photo: Google Gemini · AI-generated
Every supplier can show you a GDPR clause. Most have a data processing agreement ready to sign. That used to be the question.
The question that decides deals now is shorter. Where does our data actually live, and who can reach it. It comes up in the first meeting, from mid-sized companies that would not have asked it three years ago, and the answer a supplier gives tells you how carefully they have thought about their own operation.
The question has four answers, not one
When a company asks where its data lives, it usually means the production system. During a software project, data lives in four places.
The production system, where the application and its database run. The development and test environments, which almost always hold copies of real data and are almost always the least protected place it exists. The repositories and build pipeline, because code is data too, and configuration, credentials and sample records travel with it. And the tools developers use, which since 2025 includes AI assistants that send code, and whatever is in it, to a model somewhere.
A supplier who answers only the first has answered a quarter of the question.
Production: the part that is usually fine now
This is the solved part. Hyperscalers run German regions, European providers offer hosting from German soil, and a private cloud or a rack in your own building is still a valid answer. The choice depends on the obligations, not on fashion.
A medical products group’s ERP runs on a private Windows cloud because its industry’s residency and control requirements say so. A construction company’s subcontractor portal runs on a private German cloud for the same reason. A machinery manufacturer’s purchasing portal runs on the company’s own on-premises infrastructure, because that is where the rest of their systems live. Three clients, three answers, each made with the client rather than for them. Residency is a decision now, not a limitation.
Test environments: where the copies live
The habit in most teams is to copy production into test. It is convenient, and it means the least protected environment holds the most sensitive data. So the rules we apply are simple. Test data lives in the same jurisdiction as production. It is anonymised where the application allows. And test infrastructure is disposable where it can be: a fresh database container per pipeline run, thrown away afterwards, rather than a shared test database that has quietly held a copy of last year’s customers for eighteen months.
The pipeline: code is data
Repositories, build runners, artefact stores and the secrets that deploy the system are all places where client material sits. Ask where the runners are. Ask where the secrets are stored and whether they ever exist inside a repository.
Our answer: our build pipelines run on infrastructure in Germany. Secrets are injected at deploy time and never live in the code. Client code and data stay in the EU during development, although our team is distributed. That is a deliberate setup, not a coincidence of where a server happened to be, and our CEO owns it personally.
The new one: the AI tooling
Every developer now works with an AI assistant, and every prompt carries code and sometimes data. This is the question most suppliers have not been asked yet and have no answer for. Which provider. Which region. Is the material used for training. What is retained, and for how long.
We chose our AI-assisted engineering tooling on exactly those criteria. It runs on infrastructure in Germany, so a client’s code does not leave the EU when a developer asks a model to explain it, test it or refactor it. For a DACH buyer this is not a compliance footnote. It is the difference between a supplier who has read the question and one who has not.
Six questions before you sign
For each of the four places, where is it, by country. Who has administrative access to each, by name or role. What leaves the EU at any point, and why. Whether test data is real, and if so, how it is protected. What happens to every copy when the contract ends. And whether an NDA is in place before the first document changes hands.
A supplier who can answer all six without a pause has thought about their own operation. One who can answer only the first has a hosting region and a hope. Read how our delivery model and our delivery infrastructure are set up, or talk to us and ask the six questions yourself.