EU data residency is not optional

Pseudonymized data is still personal data under GDPR. Routing it to a US model is still a transfer that needs a legal basis. A checkbox does not change that, and neither does a vendor's promise that they will not train on your data. Training is not the only question. Location is.

The transfer is the problem, not the storage

Teams tend to treat data residency as a storage question: where does the database live. For AI, the sharper question is where the inference happens. A single chat completion can carry a name, a case number, a diagnosis, or a salary into a model hosted outside the EU. Under GDPR that is a transfer, and it needs a lawful basis: a data processing agreement, Standard Contractual Clauses, and a transfer impact assessment that holds up.

Recital 26 is explicit that pseudonymized data, where identifiers have been replaced but could still be linked back, remains personal data. So the common mitigation, "we tokenize before we send," reduces exposure but does not remove the obligation. It changes the risk profile. It does not change the rulebook.

Enforced, not configured

Most platforms treat residency as a setting. Someone toggles a region in a dashboard, and from then on the guarantee is only as good as everyone remembering to leave it alone. Settings drift. People copy a config from another project. A new provider gets added without the region flag.

Akumi holds residency at the egress guard, in code, on every request. A request never reaches an external or non-EU model unless you have explicitly allowed it, with personal data pseudonymized by the firewall or a recorded acknowledgment from an authorized admin. The default is EU-only. There is no silent path out of the region, because leaving the region is the thing the guard is built to stop.

Crown-jewel data can stay pinned

Not all data carries the same risk, and your routing policy can say so. Lower-risk traffic can reach an external model where it earns its place on capability or cost. Your most sensitive classes can be pinned to EU-only models, so that even with an override available, the crown jewels never have a route out. The policy lives in one place and applies on every request, instead of being scattered across services and half-remembered.

What a reviewer sees

The test of a residency story is not the marketing page. It is the moment a DPO or an auditor asks where a specific request went. With Akumi the answer is a record: per-request residency, which model ran, in which region, through which provider, and why the guard allowed it. Metadata only, with no prompts or completions stored. You hand over the log, not a reassurance.

Residency is not a feature you switch on. It is the shape of the system, and it should be provable on demand.