EU Data Residency Without Germany: Austria, Poland and Romania

Plenty of hosting decisions are made by a clause in someone else's contract. A customer asks where their data will be stored, an auditor asks for the country, a public sector tender says the EU and nothing but the EU, or a client simply says they would rather their records did not sit in the same country as a competitor. All of those are answered by choosing a city, not by buying a bigger server.

This post covers what data residency does and does not give you, which of our sites are inside the EU, and how to move a workload east without paying for it in latency. It is written as practical hosting guidance and not as legal advice. If a contract turns on the answer, have it read by someone qualified to read it.

Residency, sovereignty and compliance are three different things

• Data residency is a factual statement about where the bytes physically sit. It is the easy one, and it is the one a hosting provider can answer precisely.
• Data sovereignty is about which laws can reach the data, which depends on where it sits and also on who operates the infrastructure and where that company is established. Residency alone does not settle it.
• Compliance is about what you do with the data: the lawful basis, the retention, the access controls, the records. A server in the right country does not make an application compliant, and no provider can sell you that outcome.

The useful mental model is that residency is a necessary input to a compliance story and never the whole story.

Where our virtual machines actually run

We rack bare metal in twelve countries, and virtual machines run in five of them. All five are inside the EU and the EEA, which means the GDPR applies in full at each site with no transfer mechanism needed between them.

City	Country	Supervisory authority	From Frankfurt
Frankfurt	Germany	The federal and state authorities, under the GDPR and the BDSG	1 ms
Amsterdam	Netherlands	Autoriteit Persoonsgegevens	3 ms
Vienna	Austria	Datenschutzbehörde	4 ms
Warsaw	Poland	UODO	7 ms
Bucharest	Romania	ANSPDCP	10 ms

Germany is often chosen by reflex because the BDSG is among the stricter national implementations, and that is a reasonable default. It is not the only answer, and sometimes it is the wrong one.

When not Germany is a real requirement

Four cases we see regularly, none of which is about the law being weaker somewhere else.

• A contract names a country. A customer or a tender specifies Austria, or specifies the EU with an exclusion. There is nothing to argue about, you simply need the site.
• Commercial separation. A business does not want its records in the same jurisdiction, or sometimes the same facility, as a direct competitor or a partner it is negotiating with.
• Regional reach. Users in Poland are served visibly better from Warsaw than from Frankfurt, and users across Austria, Hungary, Slovakia and Slovenia are served better from Vienna. Residency and latency point the same way.
• Cost. Romanian transit is inexpensive relative to Western Europe, and Bucharest is our base price on every plan. If the data must be in the EU and the users are not in the west, there is no reason to pay the Frankfurt fee.

What moving east costs you

Very little, and it is easy to quantify. Vienna is 4 ms from our Frankfurt hub, Warsaw is 7 ms and Bucharest is 10 ms. For a website, an API or a database that sits next to its application, none of those figures is perceptible. They only matter when two halves of one system end up separated, which is the mistake to avoid: keep the application and its database in the same city and the round trip disappears.

The price difference runs the other way. Using our live monthly figures including the location fee, the same 8 GB machine is €17.00 in Frankfurt or Vienna, €15.00 in Amsterdam or Warsaw and €11.00 in Bucharest. The full table for all six plans is in our price by location breakdown.

Testing the move before committing to it

You do not have to take a latency claim on trust, including ours. Every plan can be taken by the hour, at the monthly price divided by 720 plus the location fee divided by 720. An Ion is €0.0084 an hour in Vienna and €0.0063 in Bucharest.

So the sensible procedure is to spend about ten cents finding out:

1. Order the smallest plan by the hour in the candidate city.
2. Deploy the application, or at least the part that answers a request.
3. Measure from where your users actually are, not from your own desk, and measure the database round trip too.
4. Keep it or delete it. Deleting is what stops the charges, since a powered off machine still holds its disk and its address.

Anything you keep permanently should move to a monthly, quarterly or annual cycle, because 720 hourly units cost exactly the same as one month and there is no cap above that.

Practical steps for a residency requirement

1. Write down what is in scope. The database is obvious. Backups, logs, error tracking, email delivery, analytics and any external service you call are the ones that break a residency claim, because a perfectly placed server can still ship its logs somewhere else.
2. Pin the location at order time. The city is chosen on the order form and the machine stays there. If you need it in writing for an audit, ask us and we will confirm the site for your service.
3. Keep backups in the same region. A backup is a copy of the data and belongs inside the same boundary as the original. Our guide on automating backups covers the mechanics, and a second machine in another EU city is a legitimate destination.
4. Handle access, not only storage. Who can log into the box is part of the same question. Keys rather than passwords, a firewall that allows your own addresses only, and a record of who has access. The basics are in server security best practices.
5. Ask before you sign. If a clause names a city, a facility or a specific arrangement, send it to us first. We would rather tell you what we can and cannot support than discover the gap after the contract is signed.

What to choose

• EU, and Germany is fine. Frankfurt, our best connected site.
• EU, not Germany, users in Central Europe. Vienna.
• EU, not Germany, users in Poland or the Baltics. Warsaw.
• EU, cost sensitive, or under regular attack pressure. Bucharest.
• EU, high bandwidth distribution. Amsterdam.

Plans and cities are on the VPS page, each site is described in more depth on the locations page, and the decision procedure in choosing a datacenter location covers the non legal half of the question.