Pinning a database to an EU region is the easy part. Personal data also ends up in logs, backups, error reports, analytics, search indexes, queues and support tools, and many of those default to another region. Find them by following the data, not the architecture diagram.
The usual leaks
- Application logs. Request bodies, emails in URLs and user IDs often land in a central log store in a default region.
- Error trackers. Stack traces and breadcrumbs capture form values and tokens.
- Backups and snapshots. Cross region replication for resilience can quietly move data out. Check destination regions.
- Analytics and product telemetry. Event streams carry user identifiers.
- Search and vector indexes. Hosted search or embedding services copy content.
- Message queues and dead letter queues. Failed messages sit with full payloads.
- CI and test data. Production dumps used in staging outside the region.
- Support and CRM tools. Customers paste personal data into tickets.
- LLM calls. Prompts with personal data sent to an inference endpoint in another region. See region pinning for AI APIs.
- Vendor access. Staff abroad reading data remotely is a transfer even when storage is local, according to the EDPB.
How to find them
- Search your infrastructure as code for region settings, replication rules and default destinations.
- Look at outbound network egress by destination for a week.
- Inspect a sample of log lines, error events and queue messages for personal fields.
- Read each vendor's data processing terms for hosting locations and sub-processors.
- Ask each team which third party SDKs they added.
An SBOM and dependency inventory help with the last item, since SDKs are dependencies. See inventory your dependencies.
How to fix them
- Scrub personal data at the source with logging filters and field allowlists.
- Set explicit regions on every managed service, with no defaults.
- Add a policy check in CI that fails when a resource is declared outside approved regions.
- Replace raw identifiers in analytics with pseudonymous ones, remembering that pseudonymised data is still personal data under GDPR.
- Set short retention on logs and dead letter queues.
Prove it
Keep a one page residency statement per product: each data store, its region, backup destination, log destination, and support access paths. Update it when architecture changes.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the gate and see how a policy can block a change before it merges. The same idea works for a rule that rejects infrastructure code that names an unapproved region.
Quick check
Are backups in another EU country a problem?
Moving within the EEA is not a transfer to a third country. A customer contract may still name specific countries, so check it.
Sources
Last reviewed: 19 October 2026.
