Networking
AI data residency vs sovereign AI: what to check in vendors
AI data residency is more than where files sit. See what to ask vendors about transcripts, inference, and logs before you buy.
By Eli Mogul
Takeaways
AI data residency is where your prompts, transcripts, embeddings, model calls, and logs are stored and processed, and a vendor's in-region claim only counts if it covers every one of those hops rather than just the storage bucket.
- Data residency is location, data sovereignty is whose law can reach the data, and sovereign AI puts the whole stack (data, models, compute, and operator) under one jurisdiction.
- GDPR restricts transfers out of the EU instead of mandating storage inside it, and the EU AI Act adds duties by risk class without a residency rule of its own.
- For a voice agent, check the speech-to-text, inference, and text-to-speech regions separately, because each one can run with a different vendor in a different country.
What is data residency?
Data residency is the physical or geographic location where your data is stored and processed. AI data residency asks that question again at every system your customer's data passes through, and an AI agent passes it through more systems than most teams expect.
Which data control does my AI deployment need?
- EU customers, GDPR is the only rule: check transfer safeguards before storage location. GDPR restricts data leaving the EU rather than mandating that it stay inside.
- EU data held by a US-owned cloud provider: treat it as a sovereignty gap, not a residency win. The 2018 CLOUD Act lets US legal process reach data stored in Frankfurt.
- Local law says data cannot leave: require localization for every prompt, transcript, embedding and log. An in-region storage bucket alone does not satisfy the mandate.
- Public sector, model operator must be local: scope a sovereign AI stack with data, models, compute and operator under one jurisdiction. Residency alone leaves who runs the model unanswered.
- Voice agent handling customer calls: audit speech-to-text, inference and text-to-speech regions one by one. Each hop can run with a different vendor in a different country.
What is data sovereignty?
Data sovereignty is the question of which country's laws and authorities can reach your data, wherever it physically sits. A server in Frankfurt answers the residency question. The legal home of the company that runs that server answers the sovereignty question.
What is sovereign AI?
Sovereign AI is an AI stack whose data, models, compute, and operator all sit under one jurisdiction's control. It is the strictest of these terms, because it covers who runs the model and who can be compelled to hand over its inputs and outputs, as well as where the files live.
Four terms get used as if they mean the same thing. This is how they differ.
Residency, localization, sovereignty, and sovereign AI compared
| Term | What it governs | The question it answers |
|---|---|---|
| Data residency | Where data is stored and processed | Which country's data center? |
| Data localization | A legal mandate that data stay in one jurisdiction | Is it allowed to leave? |
| Data sovereignty | Whose law and authorities reach the data | Who can compel access? |
| Sovereign AI | Data, models, compute, and operator under one jurisdiction | Is the whole stack in-country? |
How these concepts overlap
The same dataset can pass a residency check and fail a sovereignty check. The US CLOUD Act, passed in 2018 and codified at 18 U.S.C. 2713, requires a provider subject to US jurisdiction to preserve and disclose data in its possession or control, whether that data sits inside or outside the United States. EU data held in an EU region by a US-controlled provider meets residency and stays within reach of US legal process.
Example: Your customer records sit in Frankfurt. Your provider is subject to US jurisdiction. A US warrant can still reach them, so residency passes and sovereignty fails.
If you are building a voice agent that has to keep call data in-region, Telnyx Voice AI documents where inference runs and where conversation data is stored.
Check every hop of your voice agent
Speech-to-text, inference, and text-to-speech can each run with a different vendor in a different country, so verify each region separately.
What AI data residency means for AI workloads
AI data residency is the location where your data is stored and processed at every stage of an AI workload, including the copies an AI system makes for itself. The training set is one of those stages, and for most voice and chat agents it is the least active one.
Follow a single customer interaction in the order it is processed. The record lands in a database, where residency is easy to prove. It is copied into a retrieval index or a fine-tuning set. It is sent as a prompt to a model endpoint. It comes back as a response and leaves a log behind. Each step can happen in a different place, run by a different company.
Training, fine-tuning and retrieval: where your data is copied
Every copy is a new residency question. A common failure looks like this: your dataset is stored in-country, its embeddings are generated in a GPU cloud in another country, that job is logged by a third-party monitoring service, and the same embeddings are reused across inference pipelines. The original files never moved, yet your customer's content now lives in three places you did not choose. Teams that assemble agents from separate voice AI orchestration tools meet this problem first, because each tool brings its own storage and its own vendors.
Derived data: An embedding, a transcript, or a model output generated from a regulated record carries the same regulated content. For residency purposes, treat it as that record.
Inference and logs: where your prompts and transcripts go
Inference is three events, and each one needs its own answer. The request carries your prompt and the conversation context to wherever the model is served. The response comes back from that same place. The retained log keeps both, sometimes with the full transcript, for as long as the vendor's default allows, and retention is where many in-region claims quietly stop applying.
These are the questions to ask at each stage.
AI pipeline stages and what to ask
| Pipeline stage | What data moves | What to ask the vendor |
|---|---|---|
| Training or fine-tuning | Your records, with their consent and anonymization status | Is our data used to train, and where? |
| Retrieval store and embeddings | Vector copies of your documents | Which region hosts the index? |
| Inference | Prompt, context window, and response | Which region serves the model? |
| Logs and retention | Full transcripts and outputs | Where are logs kept, and for how long? |
Why enterprise IT needs both data residency and sovereign AI
Residency alone controls where the original files sit. It leaves derived data, model endpoints, and sub-processors uncontrolled, and those are exactly the parts of an AI system that move. Sovereign AI closes that gap by asking who operates each layer, so you need both answers before you tell a customer their data stays in-country.
What are the AI data residency requirements by region?
No major privacy law in the EU or the US requires AI data to be stored inside one region. The laws restrict where data may go and who may reach it, so AI data residency compliance comes down to knowing which hop crosses which border.
GDPR and the EU AI Act
GDPR does not require you to store personal data inside the EU. GDPR Chapter V restricts transfers of personal data out of the EU and EEA and allows them on three routes. Article 45 covers countries with an adequacy decision. Article 46 covers appropriate safeguards, including standard contractual clauses (SCCs) and binding corporate rules (BCRs). Article 49 covers derogations for specific situations, such as explicit consent. Prompts, transcripts, and model outputs that contain EU personal data need one of these routes every time they leave.
The EU AI Act, Regulation (EU) 2024/1689, entered into force on Aug. 1, 2024, and phases in its obligations by risk class. Its bans on prohibited practices applied from Feb. 2, 2025, and its duties for general-purpose AI models applied from Aug. 2, 2025. The AI Act regulates how an AI system is built and used. It sets no storage location of its own.
The US CLOUD Act and state privacy laws
The US has no federal data residency law. State privacy laws, such as California's, give residents rights over their data without fixing where it is stored. The CLOUD Act matters more for AI vendors, because it follows the provider rather than the server.
What each law requires for AI data
| Law | Does it mandate in-region storage? | What it means for AI data |
|---|---|---|
| GDPR | No. It restricts transfers out of the EU and EEA. | Prompts, transcripts, and outputs with EU personal data need a Chapter V route to leave. |
| EU AI Act | No. Obligations by risk class, in force since Aug. 1, 2024. | Transparency and risk duties apply to the AI system itself. |
| US CLOUD Act | No. It reaches providers under US jurisdiction wherever data sits. | A US-controlled vendor's EU region does not give you sovereignty. |
Localization regimes outside the EU and US
Some countries do mandate in-country storage. China generally requires personal data collected in China to be stored there and puts cross-border transfers through security assessments. Russia requires personal data of Russian citizens to be stored and processed on servers inside Russia. Australia has its own rules for sensitive sectors, covered in our guides to Australia data sovereignty and voice agents in Australia.
How public agencies evaluate AI vendors on data residency
Ministries and public agencies evaluate AI vendors on evidence. Their questionnaires ask for the region of every processing hop, a sub-processor list with a region for each entry, and current audit reports. A marketing line about EU hosting fails that test, because it answers for the product and leaves the hops unanswered.
Public sector: A residency questionnaire asks where every processing hop and every sub-processor runs, with audit evidence. Answer it per hop.
AI with data residency options: how to compare platforms
Comparing AI with data residency options takes five steps, and the same steps work on any vendor in a shortlist of top voice AI providers.
- Map every hop your customer data touches, from the phone call to the retained log.
- Ask each vendor for the processing region of each hop, in writing.
- Read the sub-processor list, including the vendor's own model providers.
- Check where logs and recordings are kept and for how long.
- Get the answers into the data processing agreement (DPA), with SCCs or BCRs for any hop that crosses a border.
How to evaluate AI vendors for sovereignty
Start with the questions a vendor can answer in one email. A vendor that answers each one with a region, a retention period, or a contract clause is ready for procurement. A vendor that answers with a policy page is not.
- Which region serves inference for our tenant?
- Are prompts and responses logged, where, and for how long?
- Who are your sub-processors, and where does each one process data?
- Is our data used for training?
- Which transfer mechanism is in the DPA if data leaves the region?
Questions to ask about sub-processors and model providers
A hosted AI vendor often calls a model provider of its own. "Our servers are in Frankfurt" then tells you where the vendor's application runs and nothing about where the model call lands. Ask for the full sub-processor list with a region per entry, and count each extra vendor in your stack as one more region to verify. Our Telnyx vs Twilio comparison shows how quickly a multi-vendor call path adds those entries.
What counts as evidence: regions, DPAs and audit reports
Written regions and DPA clauses tell you what a vendor commits to. Audit reports tell you whether its controls work. SOC 2 Type II shows audited controls operating over time, ISO 27001 shows a formal security management program, and GDPR applies the moment EU personal data enters the call.
"For voice AI, SOC 2 Type II and ISO 27001 both help prove general vendor security maturity: SOC 2 shows audited controls operated effectively over time, while ISO 27001 shows the vendor runs a formal, internationally recognized security management program. HIPAA matters most in healthcare when the voice AI handles protected health information: individually identifiable health information tied to a patient or member, such as PII, symptoms, diagnoses, appointment details, prescription information, and insurance/member IDs. PCI DSS matters when payment card data touches the call flow. GDPR matters when EU personal data is involved. None is universally the most important; the right answer depends on what the AI hears, stores, transcribes, analyzes, and passes downstream." Olive Morris, Regulatory and Government Affairs Associate at Telnyx |
EU and UK AI data residency: where can inference run?
For EU and UK callers, the endpoint that answers your residency question also answers your speed question. A model call that crosses the Atlantic adds a round trip to every turn of the conversation, and in a voice call every turn is delay the caller hears.
EU AI endpoints: residency and latency go together
The fastest AI endpoint with EU data residency is one that runs in the EU, close to the caller and the telephony that carries the call. Our guide to voice AI in Europe covers the sovereignty side of that choice in more depth.
"A 1-second delay can spike call abandonment by 23% and kills natural conversation. Most AI voice projects fail because they're stitched together from too many APIs and vendors." Ian Reither, COO at Telnyx |
If you have a developer, a single request shows what a pinned region looks like. Telnyx documents inference data residency for its Inference API: a request with region set and mode set to strict runs in that region or fails with an error, and it must be sent to that region's API domain.
UK AI chat and voice: a separate regime from the EU
UK GDPR has been its own regime since Brexit, and EU-to-UK transfers rest on an adequacy decision that the European Commission renewed in December 2025, running to December 2031. Treat the UK as a separate jurisdiction when you ask an endpoint vendor these questions:
- Which region serves the model?
- Do logs stay in that same region?
- Are the UK and EU separate deployments?
- Which transfer mechanism covers any hop that leaves?
Voice agent data residency options for customer communications
An in-region claim for a voice agent has to hold at four separate hops: transcription, inference, text-to-speech, and recordings. If you can name the region and the retention period of each one, you can answer any customer, regulator, or procurement questionnaire that asks where the call went.
The call path: transcription, inference, text-to-speech and recordings
Audio arrives on one of your phone numbers, which Telnyx offers in 140+ countries, and the media edge handles the raw audio. A speech-to-text API turns that audio into a transcript. The transcript goes to a model as a prompt and comes back as a response. A text-to-speech API turns the response into synthesized audio. A recording and a transcript are kept afterward. Each hop can run with a different vendor in a different region, which is also where voice AI on calls tends to break under load.
One voice agent means five residency questions.
Residency checks along a voice agent's call path
| Call-path hop | Data it handles | Residency control to ask for |
|---|---|---|
| Phone number and media | Raw audio | Region of the media edge |
| Speech-to-text | Transcript | Region of the STT model, and whether transcripts are stored |
| Inference | Prompt and response | Region serving the model, and log retention |
| Text-to-speech | Synthesized audio | TTS provider region, since TTS is often a third party |
| Recordings and transcripts | Retained content | Storage region and retention period |
Retention controls to ask every communications provider for
Retention decides how long a residency problem lasts. Ask every communications API provider for retention you can set, deletion you can trigger, and a written answer on where recordings live, and compare providers on those three answers. Teams running voice AI in production and large contact center solutions treat these as launch requirements.
Retention: Ask for retention you can set, deletion you can trigger, and a written region for recordings. A provider that cannot answer per hop cannot answer a regulator.
How Telnyx approaches sovereign communications infrastructure
Telnyx runs telephony, transcription, inference, and text-to-speech on one platform, so the call path has fewer vendors and fewer regions to verify. The Telnyx data residency documentation states each control and its limits. Storage at rest follows your data locality setting (US, EU, APAC, or Middle East) as a hard control. Voice agent processing is steered to a region by the anchorsite on the call's application, and Telnyx states that it will endeavor to honor it but does not guarantee it. Several speech-to-text models and Telnyx's own voices run on Telnyx infrastructure, as do open models such as Qwen and Kimi, while third-party models send that step to the vendor. A data-retention setting stops conversation content from being stored, and recordings, which are on by default, can be turned off or sent to your own storage. You can connect an existing phone system through SIP trunking, backed by a 99.999% uptime SLA, and teams in healthcare communications can compare options in our roundup of healthcare voice AI agents.
"Other “voice AI” companies route calls across the Atlantic adding lag, risking compliance and killing the customer experience. Telnyx fixed that." Ian Reither, COO at Telnyx |
AI data residency FAQ
Can a voice AI agent keep call audio, transcripts and inference inside my country?
It can for storage, and in most cases for processing too, if every hop runs in your region. Check the phone number's media edge, the speech-to-text model, the inference endpoint, the text-to-speech provider, and where recordings are stored. Ask each vendor whether its processing region is a guarantee or a best-effort preference, and get the answer into your DPA.
Does my provider need a local data center to meet UAE or UK data residency rules?
Not always. Many rules restrict transfers or require safeguards rather than demanding a local data center, but sector rules and customer contracts often ask for in-country storage and processing anyway. For the UK, EU-to-UK transfers currently rest on an adequacy decision. For the UAE, confirm the rules for your sector with counsel, then ask your provider for a region per hop that matches them.
What is data residency?
Data residency is the physical or geographic location where your data is stored and processed. It answers where the data sits. Data sovereignty answers whose law can reach it.
What is AI data residency?
AI data residency is where your data is stored and processed at every stage of an AI workload: training and fine-tuning sets, retrieval indexes and embeddings, inference requests and responses, and retained logs and transcripts.
Does keeping data in-region make AI compliant?
No. Storage in-region covers one hop. Compliance also depends on where inference runs, which sub-processors handle the data, how long logs are kept, and whether a provider under foreign jurisdiction can be compelled to hand data over.
Get a per-hop answer for your voice agent
You now know which hops to ask about, from transcript to inference to logs. Put the same five questions to Telnyx Voice AI and read the documented answer for each hop in the inference data residency docs.
Explore Telnyx Voice AIShare on Social
