Independent software research43 records · prices verified 13.09.2026
Working with client data

Where your AI tools are hosted, and when it matters

Data residency for freelancers and small teams: when the vendor's location changes what you can sign, when it does not, and how to answer a client who asks.

Reviewed by the editorial desk · 12.08.2026

Most freelancers never think about where an AI tool runs until a client asks. Then it becomes urgent, and the honest answer is usually 'I need to check' — which is a bad answer to give in a procurement call.

This is not a legal guide. It is the short version of what actually changes depending on where a tool is hosted, so you can tell the difference between a real constraint and a nervous question.

KEY TAKEAWAYS
  1. The vendor's country matters less than what its contract says about sub-processors and deletion.
  2. For most freelance work, no client will ask — but the ones who ask will ask early.
  3. A European vendor simplifies the conversation; it does not end it.
  4. Free plans usually come with the weakest data terms of any tier.

When it genuinely matters

Three situations turn hosting from a detail into a blocker: the client is a public body, the work touches health or financial records, or the contract you are signing names a specific jurisdiction. In those cases someone will eventually ask for a data processing agreement, and 'I use ChatGPT for drafts' is a statement with consequences.

If none of those apply — most marketing, design and general consulting work — hosting is a preference rather than a requirement. Spending a week choosing a vendor on residency grounds for a blog-writing workflow is time you will not get back.

What actually changes

The useful questions are narrower than 'where is it hosted'. Does the vendor train on your inputs by default, and can you turn that off? How long is data retained after you delete it? Who are the sub-processors, and does the list change without notice?

Those answers live in the terms, not in the country. A US vendor with a clear no-training default and a signed agreement is often a safer answer to a client than a European one with vague retention language.

Where a European vendor helps

It shortens the conversation. When a client's procurement form asks whether data leaves the EU, being able to answer plainly saves a round of emails and sometimes a legal review. Mistral is the obvious example in this set, and it is the reason it appears here at all.

What it does not do is remove the need to read the terms. Being European is a fact about the company, not a guarantee about the product tier you are on.

How to answer the question

Keep a one-paragraph answer ready: which tools touch client material, whether inputs are used for training, and what you do with the output. Most clients want to know you have thought about it, not to audit you.

If you cannot answer for a tool, that is information. It usually means the tool is on a free tier whose terms you never read, which is the most common gap in a freelance stack.

Frequently asked questions

Does using a free plan change my obligations?

It can change the vendor's. Free tiers often carry weaker commitments on training and retention than paid ones, and that difference is rarely visible in the interface. If client material goes through a tool, the tier matters.

Is a European vendor always the safer choice?

No. It removes one question from a procurement form and leaves the rest. A vendor's retention, training and sub-processor terms decide more than its address does.

Do I need a data processing agreement?

If a client's contract requires one, yes, and you will need it from the vendor rather than writing it yourself. Most vendors publish one; whether it covers your plan tier is worth checking before you promise anything.