A careful European buyer asks three things before choosing a sales agent: where the data is kept, which country's law can reach it, and how much the AI may decide on its own. This page sets out how Europe answers them, how we build SYNC by those answers, and where we still fall short.
Stored in Ireland. AI models outside the EU, or in no fixed region. A person approves before anything is sent.
Twice in five years, the EU's highest court struck down the framework the Commission had approved for sending personal data to US companies. A third framework has been in place since 2023. It has passed a first court test, and an appeal followed.
At the same time, a country's law can follow its companies abroad. That is not only American: since 18 August 2026, EU law also lets an authority in one member state, in criminal proceedings, order a service provider offering services in the EU to hand over electronic evidence, wherever the data is stored (Regulation (EU) 2023/1543).
Storing data in Europe answers where it is. Which law reaches it depends on who holds or controls it, and where that company and its group are established or do business. That is why a careful European buyer asks both questions.
On 6 October 2015 the Court of Justice of the EU declared invalid the Commission's Safe Harbour decision. That was an adequacy decision: the Commission's finding that a country outside the EU protects personal data well enough for data to go there without further conditions.
CJEU press release 117/15 (C-362/14)Signed on 23 March 2018. When served with valid US legal process, such as a warrant or court order, a provider of communication or cloud services must preserve or disclose data in its possession, custody or control, “regardless of whether” it is stored within or outside the United States.
Public Law 115-141, Division V, congress.govOn 16 July 2020 the Court declared the Privacy Shield adequacy decision invalid. It found that the US surveillance programmes it examined were not limited to what is strictly necessary. Standard contractual clauses, model contract terms the Commission approves for sending data abroad, remained valid, provided the sender checks that the destination country’s law lets them work in practice.
CJEU press release 91/20 (C-311/18)On 10 July 2023 the Commission adopted a new adequacy decision, for the EU-US Data Privacy Framework. It covers US companies that join the framework by committing to a detailed set of privacy obligations.
European Commission, IP/23/3721On 3 September 2025 the EU General Court dismissed an action to annul the 2023 adequacy decision, judging it as at the date it was adopted. An appeal to the Court of Justice was lodged in October 2025.
CJEU press release 106/25 (T-553/23) Appeal C-703/25 P, Official JournalThe GDPR, the EU's data protection law since 2018, is written around the person. Its first article says it protects people's fundamental rights and freedoms, “in particular their right to the protection of personal data”. The EU Charter of Fundamental Rights names that right in its own article 8.
GDPR, article 1 and recital 1The AI Act of 2024 sets rules by risk. Among its stated purposes is to “promote the uptake of human centric and trustworthy artificial intelligence”. A high-risk system must be designed so that it “can be effectively overseen by natural persons”, who can decide not to use it, override its output, or stop it. For most high-risk systems those rules apply from 2 December 2027, after a 2026 amendment.
AI Act, articles 1 and 14 Regulation (EU) 2026/1744In a joint declaration on digital rights, signed in December 2022 (a political commitment, not a law), the European Parliament, the Council and the Commission set out “a European way for the digital transformation, putting people at the centre”, with freedom of choice in dealing with algorithms and AI, and individual control over data.
Declaration on Digital Rights and PrinciplesWe aim to meet European rules such as the GDPR and the AI Act. More than that, we build software through European eyes.
In the European market that is a must. For us it is also simply how we build, because we believe every market is better for it. So SYNC is not only for Europe. The protection the European way gives people should be there for them wherever they are from.
These are the rules the product holds today, not plans. The limits are on the same page because a buyer should not have to find them later.
Our AI model providers process data outside the EU.
None of them guarantees processing in the EU. Which model handles a task depends on the task. These are the providers on our sub-processor list, with what that list says about each. Where a provider does not publish where it hosts data, the list keeps its location in brackets until it is confirmed.
| Provider | Location |
|---|---|
| Anthropic | United StatesData is stored in the US. By default a request may be processed in any region; Anthropic’s API has no EU option. |
| OpenAI | Via Groq and Together AISYNC runs OpenAI’s open models (gpt‑oss) on Groq and Together AI; no data goes to OpenAI. |
| No fixed regionGoogle may process requests in any country where it has facilities. An EU region exists on Google Cloud (Vertex AI), which we do not use. | |
| Moonshot AI (Kimi) | Via Together AIKimi runs on Together AI’s servers; no data goes to Moonshot AI. |
| Together AI (hosts open models) | No fixed regionTogether picks the data centre for each request. EU-only hosting needs a dedicated endpoint, which we do not use. |
| DeepInfra | United StatesHosts the open embedding model SYNC uses (multilingual-e5-large-instruct). [Retention terms to confirm] |
| Groq | United StatesGroq may also process in other countries where it operates. An EU region is offered on its Enterprise plan only; not used. |
A page about Europe invites big words. These are the ones we leave out, and why. Questions about any of it: innovate@isyncso.com.
Leave your work email. SYNC reads your company’s website and sends you a first look: what you sell, who probably buys it, and up to five companies scored A to D, each with its source.