EU Data Residency for US Companies: Why Frankfurt Alone Isn't Enough
A practical guide for US companies, developers and agencies that serve European customers. Status as of 09/30/2026. This is general information, not legal advice.
Short answer
- 1Data residency answers where your data is stored; data sovereignty asks which legal systems can reach it and who controls the keys and access.
- 2Putting a server in Frankfurt fixes residency. It does not by itself answer questions about who operates the service, which contracts apply, or whether a provider can be compelled by a foreign court.
- 3According to the text of 18 U.S.C. 2713 (CLOUD Act, 2018), a covered US provider must disclose data in its possession, custody or control regardless of whether it is located inside or outside the United States.
- 4For your own compliance file, the useful work is practical: a written data processing agreement, transfer clauses, encryption you control, least-privilege access and tested backups.
- 54hosting does not certify legal compliance and cannot decide your legal position. Ask your counsel.
Residency versus sovereignty
Residency is a location fact: your database sits in a datacenter in a given country. Sovereignty is a control question: which laws apply to the operator, who can administer the systems, who holds the encryption keys, and under what circumstances anyone can be required to hand data over. A Frankfurt region gives you the first. The second depends on the whole chain around the server.
The CLOUD Act. The text of 18 U.S.C. 2713, added in 2018 and read on the Cornell Legal Information Institute copy of the US Code, says that a provider of electronic communication service or remote computing service must comply with the chapter's obligations to preserve, back up or disclose data within its possession, custody or control, regardless of whether that data is located within or outside the United States. We quote no more than that. Which providers this reaches, and how it interacts with European law in a specific case, is a question for counsel.
Why this matters to you. European buyers increasingly ask more than "which region?". They ask who operates the platform, which contract governs processing and what happens on a data request. An answer that stops at "Frankfurt" leaves those questions open.
Real-world examples
SaaS company with EU customers
A US software company signs EU customers who ask where their data lives. It moves the customer database to a VPS in Frankfurt, then documents who administers it, how backups are encrypted and which sub-processors exist.
Agency serving European clients
A New York agency hosts client sites for a German retailer. It gets a data processing agreement in place with its host and keeps the list of people with server access short and named.
Startup preparing for a security questionnaire
A Series A team receives a questionnaire from a European enterprise buyer. Instead of answering only "EU region", it also describes access control, key management and incident contacts.
Common mistakes
- Treating "hosted in the EU" as a complete answer. It is an answer about location only.
- Assuming a region setting settles who can be compelled to disclose data. That depends on the provider and on the law that applies to it, which you need to ask about.
- Skipping the contract: no data processing agreement, no transfer clauses, no list of sub-processors.
- Keeping encryption keys and admin credentials wherever it is convenient, without deciding who holds them.
- Never testing restores, so the backup exists only on paper.
How 4hosting helps
4hosting is operated from Romania. Our datacenter is in the EU, in Frankfurt, not in the United States. We say this plainly so you can describe your setup accurately. We offer a data processing agreement under GDPR Article 28 and standard contractual clauses for transfers, and our security practice is aligned with ISO 27001; we hold no ISO or SOC 2 certification.
Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for hardening, access control, backups and WAF rules. Hours are requested from the client panel and do not carry over; work beyond them is accepted and billed separately. Migration is free. Support is in English and Romanian. Billing is in USD. 4hosting is not a compliance certifier and does not sign legal compliance for you.
Frequently asked questions
Is EU data residency enough for my EU customers?
Usually it is one part of the answer. Customers often also ask about contracts, sub-processors, access control and encryption. Residency alone does not address those.
Where are 4hosting servers, and who operates them?
4hosting is operated from Romania. Its datacenter is in the EU, in Frankfurt, with points of presence in Frankfurt, London and New York. There are no 4hosting datacenters in the United States.
Does 4hosting make me GDPR compliant?
No. 4hosting is not a compliance certifier and holds no ISO or SOC 2 certification; its security practice is aligned with ISO 27001. It offers a data processing agreement under GDPR Article 28 and standard contractual clauses for transfers. Your compliance remains your responsibility.