AI EU Server Hosting: What It Covers for Your Sales Emails, and What It Doesn't

BOTrento Team17 October 20269 min read

Where your data actually goes in an AI sales tool

An AI tool for sales emails usually touches your data in at least four places. Hosting claims tend to describe only the first one.

1. The application server. This is where the software runs: the interface, the logic and the scheduled jobs.
2. Storage and backups. This is the database with your enquiries, drafts and contacts, plus any backups. These can be in a different country from the application server, even when both are in the EU.
3. Model calls. When the tool drafts a reply or summarises an enquiry, it sends the text it needs to a language model provider's API. That provider runs its own infrastructure under its own terms.
4. People and sub-processors. This means support staff, monitoring and email delivery services, and anyone else who can access the data or process it for the vendor.

We cover storage versus processing in more detail in where your data is when you use AI. This article looks at the claims vendors make and how to check them.

What EU hosting does and doesn't cover

So EU hosting is a good sign about storage, but it doesn't prove compliance. GDPR is about lawful basis, transparency, contracts, security and data minimisation. Location is only one part of that. For a wider check, see whether an AI sales tool is GDPR-compliant.

How to read common hosting claims

“Hosted in the EU”

Read this as “the application and probably the database are on EU infrastructure”. Ask which countries, whether the backups are in the same place, and whether the claim also covers model calls. Usually it doesn't.

“Everything stays in the EU”

This is a strong statement. It's only true if every step stays inside the EU: storage, processing, model inference, support access and sub-processors. If the tool calls an external commercial model API, ask the vendor to show you in writing where that API processes requests and on what terms. If they can't, treat the claim as marketing.

“We don't train on your data”

Ask who “we” is. The vendor may not train models, but what matters is what the model provider does with your prompts. Commercial API terms generally say how inputs are used and how long they're kept. Ask the vendor to name the provider and point you to the relevant terms.

“EU-based AI” or “sovereign AI”

These words can describe the company, the servers or the model, and those are different things. Ask what exactly is in the EU: the legal entity, the hosting, the model inference, or all three.

“Private server” or “on-premise option”

Running the application on your own server or a dedicated EU server gives you more control over storage. But if that server still calls an external AI API, it isn't a closed system. The text in each call still reaches the model provider. Only a model running entirely inside the same environment would change that, and that comes with its own trade-offs in cost and quality.

Checklist: what to get a provider to confirm in writing

Ask these questions before you connect a sales inbox. Answers in a contract, a DPA or published documentation count for more than answers given on a sales call.

• Storage: In which countries are the application, the database and the backups?
• Model provider: Which language model provider is used, on whose account (the vendor's or yours), and where does it process requests?
• What goes to the model: The whole mailbox, or only the text needed for a specific task? Are attachments sent?
• Retention and training: What do the model provider's terms say about storing and using API inputs?
• Sub-processors: Is there a current list, and how will you hear about changes?
• DPA: Is there a data processing agreement, and does it explicitly cover AI processing?
• Access: Who on the vendor's side can see your data, and when?
• Exit: Can you export your data, and when will copies and access be removed?

For a scoring method and more detailed questions, see seven GDPR questions to ask an AI sales tool vendor.

Email template you can send to a vendor

Subject: Data location and AI processing – questions before we sign

Hello,

Before we connect our sales inbox, could you confirm the following in writing?

1. In which countries are your application, database and backups hosted?
2. Which language model provider do you use, and where are API requests processed?
3. What content is sent to the model: full emails, selected text or attachments?
4. What do the model provider's terms say about retaining or training on API inputs?
5. Please send your current sub-processor list and your DPA.
6. Who on your side can access our data, and in what circumstances?
7. How do data export and deletion work if we stop using the service?

Thank you,
[Name, company]

What you control on your side

A good answer from the vendor is only half the job. Whichever tool you choose, a few habits will reduce your exposure:

1. Map your data. Write down what goes through your sales inbox: names, phone numbers, prices, event or delivery addresses. Add the AI tool to your records of processing.
2. Minimise. Keep ID numbers, health information and bank details out of email threads that AI will read. Ask customers to send them another way.
3. Keep a person in the loop. If a person approves drafts before they're sent, your process is easier to explain to customers. The EU AI Act overview for small businesses covers this from the deployer's side.
4. Consider your own API key. With your own key, the contract with the model provider is in your name and you can see the usage. See own AI API keys in business.

If your situation is unusual, for example you process special categories of data or you work for public sector clients, check the details with a lawyer. This article is general guidance, not legal advice.

How BOTrento handles hosting and model calls

BOTrento Chief of Staff is a managed process for enquiries, quotes and follow-ups. Here's how it answers the questions above:

• Storage: data is stored on servers in the EU. The servers are in Germany and the application database is in Ireland.
• Model calls: the language model receives only the text needed for a given task, through the API of a commercial provider. By default this runs on our account. If you prefer, you can use your own Anthropic (Claude) key. The provider then bills you directly for usage on that key, with no mark-up from us. Keys are encrypted, only the last four characters are shown, and you can remove a key at any time. The API keys help page explains the setup. Commercial API providers don't use this data for training.
• Not a closed system: even with a dedicated EU server, which is available on the Managed plan, model calls still go to an external AI API. We're open about this.
• Nothing is sent automatically: BOTrento prepares drafts of replies, quotes and follow-ups, and a person approves each one before it goes out.
• Exit: you can export your data and outputs, get a description of your processes, and agree a date for removing access and copies.

You can read more about the team and approach on what BOTrento is, and see the plans on the pricing page. If you run an equipment rental business or an events and production company, the industry pages show what the process looks like in practice. The easiest way to test it is the 14-day free trial. You don't need a card or your own API key, and the 14 days only start once you've uploaded your first data.