Where does your team's chat actually live?
"Hosted in the EU" can mean a lot of things. A plain guide to data residency for small teams, and five questions worth asking any tool you use.
Most small teams pick their chat tool in an afternoon. Someone sets up a workspace, sends a link, and a year later it holds every client conversation, every hiring decision and most of the files the company runs on. Where that lands is rarely part of the decision.
It's worth a second look, especially if you work with European clients. Here's what the terms mean, without the legal fog.
What "data residency" means
Data residency is simply where your data is physically stored: which country, which data centre. When a tool says it's "hosted in the EU", it usually means your messages and files sit on servers inside the European Union.
That matters because the GDPR sets strict rules on moving personal data out of the EU (European Commission). Keeping data inside the EU avoids a whole category of questions.
Why location isn't the whole story
Data stored in Frankfurt can still be reachable by US authorities if the company running the servers is American.
The US CLOUD Act, passed in 2018, lets US law enforcement require US-based providers to hand over data in their control, wherever in the world it's stored (US Department of Justice). So alongside where the server sits, ask who owns it and which laws that company answers to.
This doesn't mean American tools are unsafe, or that anyone is reading your team chat. It means "EU-hosted" and "outside the reach of non-EU law" are two different claims, and it's fair to know which one you're getting.
Five questions to ask any tool
You don't need a lawyer for this. Most answers are in a tool's privacy policy, security page or data processing agreement.
- Where is our data stored? Look for a named region, not just "secure cloud". Check whether it covers everything (messages, files, backups) or only some of it.
- Who runs the infrastructure? The tool might be European while its hosting provider isn't, or the other way round.
- Which other companies touch our data? Every provider lists its subprocessors: email delivery, analytics, AI features. Each one is another place your data can go.
- Is our content used to train AI models? Policies on this change often. Look for a plain yes or no, and whether it's opt-in.
- Can we get our data out, and delete it? Export and deletion should be something you can actually do, with a clear timeline.
If a vendor can't answer these clearly, that's an answer too.
How to read the answers
A few patterns to watch for.
Scope. "Your data is stored in the EU" sometimes means account data only, while files or logs live elsewhere. Read what the promise covers.
Options versus defaults. Some tools offer EU hosting only on enterprise plans. If you're a team of six on the standard plan, check which side of that line you're on.
Honest limits. A trustworthy answer often includes a "but". For example, a tool that can read your content to search it or summarise it should say so, rather than implying nobody ever can.
Where Gliddi stands
Since we're asking you to ask these questions, here are our answers. Gliddi is built so product data stays in the EU, with no user data on US infrastructure. Your workspace content is never used to train AI models, and each workspace is kept isolated.
We'll also be clear about the limits: the service can read your content in order to deliver features like search, and this marketing website is separate from the product. If you'd like to try it with your team, you can join early access.