«Processed in the EU» can mean the servers are in the EU, or the servers are in the EU and the provider is EU-owned. The first is fine for much business data and not fine for some. The honest answer is to show, per model, where it runs, who owns the provider, and how long data is kept, and let the customer choose.
The three questions behind «EU-hosted»
| Question | Why it matters | What to ask a vendor |
|---|---|---|
| Where are the servers? | GDPR treats transfers outside the EEA as a separate legal step | Which region, and can we pin it? |
| Who owns the provider? | A US-owned company can be subject to US law regardless of server location | Is the provider EU-owned, and if not, is it subject to US law? |
| How long is data kept? | Prompts and outputs may be stored for abuse monitoring or support | Retention period, and can it be set to zero? |
A fourth question, whether your data is used to train models, is covered in its own article. The short version for Nrth OS: no model is trained on your data.
How Nrth OS handles it
Each company chooses a home region once: the EU (Frankfurt) or the US. For a company with the EU as home region, each assistant gets one of three data policies:
- In the EU (default). Processed on EU servers. Some providers are US-owned, and we label which ones.
- European providers only. Processed in the EU by EU-owned providers only. Fewer models, narrower capability, no US-owned model provider.
- Our own model. Tasks go to your own model endpoint: your server, or a provider you choose. See bring your own model.
Every model is labelled with region, provider jurisdiction and retention, and you can see the labels under Details when you choose the data policy. With several assistants, you can set accounting to «European providers only» and marketing to «In the EU» without changing anything else.
When is «In the EU» enough?
For many business documents, invoices, quotes, help articles, competitor research, yes. The data is commercial, and the provider’s business terms exclude training. In 2025, Statistics Norway found that four in ten non-adopting companies with at least ten employees cite data protection and legal uncertainty among their reasons (SSB, 2025).
When is it not enough?
Health data, legal case files, financial data under sector rules, defence and public-sector contracts with explicit residency clauses. For those, use «European providers only» or «Our own model» with an endpoint in the EU. The data policy applies to the models. Storage, hosting, web search and email go through the same subprocessors whatever the data policy. Some of them are US-owned.
Running everything on your own hardware (Nrth Node) is planned for a later version.
Next step
Read the full data page, or apply for the pilot program and choose your region on day one.