EU-only data for a SaaS: where to host and what to show your client

Hosting the app in the EU is the easy part. A client who says "all data stays in the EU" is asking about every service that touches their users' data, so you need a European choice for each layer, then a data processing agreement and a subprocessor list that prove it. Eurobase covers the app, Functions, files, logs and SQLite on European infrastructure. You add a European database, email, analytics, error tracking and support tool around it.

This guide isn't legal advice. Your client's contract decides what "in the EU" means, so read it first.

Your stack at a glance

Facts are from each provider's own page, checked on 10 November 2026.

What your client will check

• Every place their data lands. Logs, backups, error reports and emails count as much as the main database.
• Who operates each service. A European region isn't the same as a European company. See EU region vs EU company.
• The subprocessors behind each provider. A European tool can still run on a US cloud.
• How they hear about changes. GDPR Article 28(2) requires a processor to tell the controller before it adds or replaces a subprocessor, so the controller can object.
• What happens at the end. Ask each provider how data is returned or deleted, and for how long backups survive.

App and functions

Eurobase runs your app, Functions and containers on European infrastructure operated by Scaleway, a French provider. It's run by a business registered in Warsaw, Poland. Frameworks such as Next.js, Nuxt and Astro run on V8 isolates, and servers in Node.js, Python and other languages run as containers.

• Best for: a SaaS whose app layer you want on European infrastructure at a flat price.
• Price: a Free plan, then €10 or €20 a month + VAT for the workspace. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
• What it lacks: managed Postgres, MySQL or Redis, email sending, analytics, error tracking and support tools. ISO 27001 and SOC 2 are in progress, not held.

If you also want the database on the same platform, Clever Cloud and Scalingo both run apps and managed databases from France.

Database

On Eurobase, a Worker can use SQLite databases through the D1 API, on the same European infrastructure. For Postgres, pick a European provider:

• Clever Cloud hosts managed PostgreSQL in France, with nightly backups by default, configurable retention and downloadable archives.
• Scalingo, from Strasbourg, offers PostgreSQL 14 to 18 as an add-on next to your app.
• OVHcloud and Exoscale both sell managed PostgreSQL in European regions.

A container on Eurobase can connect with a native Postgres driver, if the database has a public IPv4 address. A Worker reaches an outside database over HTTPS only.

File storage and backups

Eurobase Storage keeps project files in public or private buckets on European infrastructure, included in the plan. For larger volumes or a second copy, use a European S3-compatible store: Hetzner Object Storage starts at €6.49 a month excl. VAT for 1 TB. More options are in European object storage.

Backups need their own line in your plan. Eurobase's terms don't promise a backup unless a signed agreement says so, and no fixed backup expiry is confirmed in its DPA. Export your SQLite data and files on a schedule to a European bucket you control, and tell your client where those copies live.

Logs

Eurobase keeps project access logs, including visitor IP addresses, request paths and user agents, on the same European infrastructure. They can be deleted 30 days after they're recorded, and older entries can be removed sooner once a project has more than 10,000 entries of one log type. Plans include 256 MiB, 1 GiB or 5 GiB of logs a month. If you ship logs to a third-party log service as well, that service joins your subprocessor list.

Email

Transactional email carries addresses and often the content your client cares about most. Lettermint says it processes and stores email data only in the EU, on its own infrastructure, as a European company with no US parent, and it's certified to ISO/IEC 27001:2022.

Being European on paper isn't enough on its own. Brevo's parent is a French company in Paris, but its privacy policy says it has operations in the United States and service providers outside the EU. Read the policy before you pick.

Analytics

• Plausible is incorporated in Estonia and says visitor data doesn't leave the EU and runs on infrastructure owned by European companies. Its Community Edition is free to self-host under AGPLv3.
• Matomo On-Premise is a free download you run on your own European server. Matomo Cloud lists Amazon Web Services EMEA SARL as its infrastructure provider, with servers in Frankfurt and backups in Dublin, so check whether your client accepts a US-owned cloud underneath.

Error tracking

Error reports often contain email addresses, request bodies and user IDs. Sentry's EU region stores data in Frankfurt, but its docs list data that may still be stored in the US whatever the region, including user accounts, project metadata, audit logs and support conversations. GlitchTip is an open-source tool that accepts Sentry's client SDKs and runs on your own server with Docker and PostgreSQL 14 or later. Its site doesn't say where the hosted version runs, so self-host it if location matters.

Support chat

Crisp IM SAS is based in Nantes, France, and says its core infrastructure uses processors in Amsterdam. Whatever tool you choose, remember that a support inbox fills up with customer data quickly.

What to give your client

1. Your data processing agreement with them, as their processor.
2. Your subprocessor list: every provider above that touches their data, with its legal entity, country and purpose.
3. Each provider's DPA and subprocessor page, linked. Eurobase's are at DPA and subprocessors.
4. A data map: which layer stores what, where, and for how long, backups and logs included.
5. Any exceptions, stated plainly. On Eurobase, GitHub, Inc. and GitLab Inc. are US subprocessors when you connect them, and Stripe handles billing. Codeberg, a German association, keeps your source connection in Europe.
6. Certifications you and your providers actually hold, not ones in progress.

Use the GDPR hosting checklist to check each provider before it goes on the list.

Frequently asked questions

Is hosting in an EU region enough if my client wants EU-only data?

Usually not. The region covers where your app runs, but logs, backups, emails, error reports and support conversations often go to other services. Each one needs a European location and a provider your client accepts.

What documents does an enterprise client ask for?

Expect a request for a data processing agreement, a subprocessor list with countries, and details on security, retention and deletion. Some also ask for ISO 27001 or SOC 2 reports, so check what each provider really holds.

Can I use GitHub if my client requires EU data?

Your source code usually isn't your client's personal data, but GitHub is a US subprocessor on Eurobase when you connect it. If your client's contract rules it out, deploy from Codeberg or your own Forgejo or Gitea server.

Does Eurobase back up my SQLite data?

Eurobase's terms don't promise backups unless a signed agreement says so. Export your data on a schedule to a European bucket you control.

Do I need to tell my client when I change a provider?

Yes, if you're their processor and they gave general authorisation. GDPR Article 28(2) requires you to inform them of an intended addition or replacement so they can object.

Sources

• GDPR Article 28
• Clever Cloud PostgreSQL
• Lettermint
• Brevo privacy policy
• Plausible data policy and Plausible self-hosted
• Matomo Cloud and Matomo Cloud subprocessors
• Sentry data storage location
• GlitchTip and GlitchTip install
• Crisp privacy policy
• Host a web app in the EU, Eurobase Workers, Eurobase plans, Eurobase Storage and Eurobase logs
• Eurobase DPA, Eurobase privacy, Eurobase terms and Eurobase subprocessors