EU and Swiss Data Residency for Virtual Data Rooms
Data residency is one of the most-discussed topics in European VDR procurement, and one of the most often misunderstood. "EU hosting" is not a single answer — it means different things to different buyers. This page explains what to ask, what to verify, and how the residency question interacts with sub-processors, backups, and contract entities.
Last updated: May 2026.
Five Questions to Ask About Residency
- Where is production data stored? (Country, ideally city.)
- Where are backups and disaster-recovery copies stored?
- Where are sub-processors located? (DNS, CDN, monitoring, customer support tooling.)
- What is the contracting entity? (EU subsidiary or US parent.)
- What happens to data on contract termination? (Deletion certificate.)
Provider Hosting Matrix
| Provider | Production hosting |
|---|---|
| Papermark | EU (DE) / US / UAE customer choice |
| Drooms | Germany & Switzerland |
| netfiles | Germany only (Munich + Frankfurt) |
| idgard | Germany only (BSI-audited) |
| Brainloop | Germany |
| Admincontrol | EU/EEA (ISO 27001 data centres) |
| Virtual Vaults | EU (Netherlands + Germany) |
| Sherpany | Switzerland and EU customer choice |
| EthosData | EU customer choice |
| FORDATA | EU/EEA only |
Common Procurement Patterns
- Maximum sovereignty. Self-hosted Papermark on a German or French sovereign IaaS (IONOS, OVH SecNumCloud, T-Systems).
- High sovereignty. netfiles, idgard, or Brainloop with Germany-only hosting and BSI C5.
- EU baseline. Drooms, Admincontrol, Virtual Vaults, FORDATA, Papermark default — EU/EEA hosting with ISO 27001.
- EU-hosted with US parent. Datasite, Intralinks — usable for non-regulated deals with appropriate Schrems II analysis.
Frequently Asked Questions
Is EU hosting required by GDPR?
No. GDPR requires lawful transfer mechanisms outside the EEA, not EU-only hosting. EU hosting simplifies compliance by eliminating the transfer question.
Does "EU hosting" cover sub-processors?
Often not. Many EU-hosted services use US-headquartered sub-processors for monitoring, email delivery, or customer support. Check the sub-processor list.
What is the cleanest answer for Swiss banking secrecy?
Switzerland-only hosting plus a Sealed Cloud architecture, or self-hosted Papermark on Swiss IaaS.