Where Your SaaS Data Lives: Jurisdiction & Data Residency Map — 2026

For GDPR, the 5/9/14 Eyes intelligence alliances, and data-residency rules, where a tool is based and stores data is a compliance and privacy decision. This maps the jurisdiction of popular tools across categories in 2026.

"Where is the data?" is a real question for EU buyers (GDPR, Schrems II), privacy-conscious users (intelligence-sharing alliances) and regulated industries (residency requirements). This page compiles the jurisdiction facts surfaced across our category studies — base country, notable residency options, and alliance membership.

Free to cite and link. Jurisdiction and residency options are factual but can change with corporate moves; confirm on the vendor's trust/legal page before relying on this for compliance.

Jurisdiction by tool

ToolCategoryBase / data residencyAlliance / note
Proton (VPN/Pass/Drive)Privacy suiteSwitzerlandOutside 5/9/14 Eyes; no mandatory data retention
NordVPNVPNPanamaOutside 5/9/14 Eyes
ExpressVPN / PureVPNVPNBritish Virgin IslandsNo mandatory data-retention law
MullvadVPNSwedenEU; anonymous accounts (no email)
SurfsharkVPNNetherlandsWithin Nine Eyes
CyberGhostVPNRomaniaOutside 5/9/14 Eyes
PIA / IPVanish / Hotspot ShieldVPNUnited StatesWithin Five Eyes
TunnelBear / WindscribeVPNCanadaWithin Five Eyes
TresoritCloud storageSwitzerland; residency selectable across 12 regionsAudited zero-knowledge
Sync.comCloud storageCanada (PIPEDA)GDPR + HIPAA; zero-knowledge default
InternxtCloud storageEUISO 27001; open source; post-quantum
BoxCloud storageUnited StatesFedRAMP High, HIPAA, ISO, FIPS, ITAR
1PasswordPassword managerCanada (AgileBits)SOC 2 Type II
Bitwarden / Keeper / DashlanePassword managerUnited StatesBitwarden self-hostable (your residency)
PersonioHREU data residency (AWS Frankfurt)ISO 27001; GDPR audited by Bitkom Consult
ESETAntivirusSlovakia (EU)—
BitdefenderAntivirusRomania (EU)—
KasperskyAntivirusCore data infra relocated to SwitzerlandBanned for US persons (Sept 30, 2024)

Key findings

  1. Switzerland is the privacy-jurisdiction magnet. Proton (VPN/Pass/Drive), Tresorit and even Kaspersky's relocated data infrastructure all sit in Switzerland — outside the 5/9/14 Eyes alliances and with strong data-protection law. For "outside intelligence-sharing + strong privacy law," it's the recurring answer.
  2. EU-residency options exist in most categories — if you look. Internxt (EU cloud), Personio (AWS Frankfurt HR), ESET and Bitdefender (EU antivirus), Mullvad (Sweden) give GDPR-aligned, EU-resident choices. For a data-residency requirement, the EU-native option is often not the default but is available.
  3. US-based tools dominate but carry Five Eyes exposure. Box, Bitwarden, Keeper, Dashlane, PIA, IPVanish are US-based. That's fine for many buyers, but for those avoiding Five Eyes jurisdictions it's a deliberate trade-off — usually offset by encryption (zero-knowledge) or self-hosting.
  4. Selectable residency is the enterprise answer. Tresorit (12 regions) and Personio (EU) let you pin where data lives — the cleanest path to meeting a hard residency rule, versus inferring it from the company's HQ.
  5. Self-hosting makes residency your decision. Bitwarden, Appsmith, Cal.com and WordPress LMSs run on infrastructure you choose — the ultimate residency control, independent of the vendor's jurisdiction.

Methodology

Jurisdiction and data-residency facts were compiled from our sourced 2026 category studies: base/HQ country, notable selectable-residency options, and 5/9/14 Eyes alliance membership where relevant. This is a jurisdiction snapshot for privacy and compliance awareness, not legal advice; HQ country and data-storage location can differ, and corporate moves change jurisdiction.

Editorial note (verification): For any GDPR/residency compliance decision, confirm the current data-storage location, sub-processors and contractual residency options on the vendor's trust/legal page (and consult counsel). HQ ≠ data location in some cases. Compiled 2026-06-27.

How to cite

"Where Your SaaS Data Lives: Jurisdiction & Data Residency Map — 2026", ToolsRanks. https://toolsranks.com/etudes/saas-data-residency-jurisdiction-2026
A spreadsheet of all jurisdictions is available on request.