Where is my data: six answers, and only one is about a country

A Microsoft documentation page updated on March 30, 2026 gives two opposite answers to the same question. When a customer enables Anthropic models in Microsoft generative AI services, its customer data remains stored in the EU Data Boundary and is processed in the United States. The country of the datacenter answers precisely for one of the six states a piece of data passes through in an agentic CRM: the one where nobody reads it.

The other five appear in no purchasing questionnaire. A delegated token reads the mailbox. The CRM writes to a store whose country is named in the contract. A retrieval engine assembles fifteen fragments. A model infers, in a geography that is a deployment parameter. A tool call opens a connection to a third-party service. A trace is written, for a duration nobody negotiated. Six holders, six retention periods, six bodies of applicable law.

Each of these six states is verifiable through a dated public document a vendor either produces or does not. Facts verified as of August 15, 2026.

"Hosted in Europe" describes exactly one state out of six

The residency checkbox is accurate, auditable, sometimes mandatory. It describes the state in which data sleeps. Yet Guidelines 05/2021 from the European Data Protection Board, final since February 2023, characterize a transfer by the act of making data available, and remote access from a third country is enough once the three cumulative criteria of a transfer are met. The GDPR itself imposes no localization at all.

The symmetry even tilts the other way: localization is sometimes hard law on the American side. Clause DFARS 252.204-7021 has appeared in Defense contracts since the CMMC rule took effect on November 10, 2025. What agents change is therefore not the rule of law, it is the number of points of access triggered by a single email. The agent even feeds its own output back in, and the last three states repeat on every turn.

A legal order does not target a country, it targets a holder

Six points of access mean six holders. A legal order targets a holder, not a country. On June 10, 2025, before the French Senate inquiry committee on public procurement, Anton Carniaux, director of public and legal affairs at Microsoft France, answered under oath "No, I cannot guarantee it" to the question of a transfer to US authorities without French consent, while specifying that the case had never arisen.

The test under the CLOUD Act of March 23, 2018 is the control exercised by a provider subject to US jurisdiction, wherever the data is stored. In the second half of 2025, Microsoft reports 190 requests from authorities targeting enterprise customer accounts, 51% of them rejected, withdrawn or yielding no disclosure, and 45 content disclosures. Over the same period, Microsoft reports 3 content disclosures to US authorities concerning non-US customers whose data was stored outside the United States. No public case documents this in the Union, and the secrecy of such proceedings makes that absence inconclusive.

What can be verified is clauses, and Article 32 of the Data Act has supplied the template since September 12, 2025. Extraterritoriality is no country's specialty: on September 25, 2025, the Ontario Court of Justice ordered OVHcloud, a French group, to hand over to the Canadian federal police subscriber data hosted in France, the United Kingdom and Australia.

The document that was supposed to name the holders no longer names them

Naming those six holders is the prerequisite. The subprocessor list in the data processing agreement was designed for exactly that, but for a stable chain revised once a year. It fails at the AI layer: out of 2,400 vendors analyzed by DataGrail for its May 27, 2026 report, 63.6% of those promoting AI capabilities name no third-party AI subprocessor in it.

The Fourth-Party Map study from SupplierShield, published on July 8, 2026 and covering 163 vendors, adds that 92% cite AWS, 52% OpenAI and 40% Anthropic, and that roughly four in ten have pulled their list off the open web. On top of that come network links no list names, such as the cloudflared that Anthropic places in the path of MCP tunnels.

The topology crosses in both directions: Microsoft and Mistral AI announced on July 21, 2026 an agreement placing Mistral models in Microsoft Foundry, while the AWS European Sovereign Cloud, opened on January 15, 2026, is operated by a wholly owned subsidiary of Amazon.com. What should be demanded is therefore not a nationality, it is a versioned, public list naming the model provider, its host and the network components.

The processing and retention regime is decided at call time

A list, however exemplary, describes the chain on the day of signature, while the agent picks model, region and endpoint on every call. In Anthropic's documentation reviewed on August 15, 2026, inference_geo accepts only "us" and "global", and the workspace geo that governs storage at rest exists only as "us". European residency therefore assumes a third-party cloud.

Retention is a second setting: since June 9, 2026, Anthropic's policy on Covered Models imposes 30 days of retention and makes zero data retention unavailable. Call a feature that is not eligible and nothing blocks the request, the usage itself counting as a choice to step outside the agreement. At OpenAI, zero data retention excludes stateful endpoints, Assistants, Threads and Vector Stores included, meaning the very primitives an agent architecture lives on.

The default setting decides in the contract's place: on March 27, 2026, Microsoft documented a flex routing that lets Microsoft 365 Copilot inference leave the EU Data Boundary at peak times, enabled by default for eligible tenants created after March 25, 2026.

The tool call: the one segment no contract describes

Region, retention and endpoint are at least written down somewhere. The tool call is written down nowhere. Between August 8 and August 18, 2025, OAuth tokens from the Salesloft Drift integration were used to exfiltrate Salesforce objects at scale. The Google Threat Intelligence Group attributed the campaign to the actor UNC6395 on August 26, 2025, more than 700 organizations were potentially affected, and Drift was taken offline on September 3, 2025. No model vulnerability was exploited.

Once the agent acts, the perimeter becomes a property of the call rather than of the contract. The NSA writes in its May 20, 2026 sheet on the Model Context Protocol that the protocol does not define how a session binds to a verifiable identity and that authentication is optional rather than mandatory. Censys counted 12,520 reachable MCP servers as of April 28, 2026, roughly 40% of them without authentication, and Wiz published on July 28, 2026 that about 42% of exposed servers return real data.

No clause describes what the protocol does not name. EchoLeak, the CVE-2025-32711 flaw disclosed in June 2025, made it possible to exfiltrate OneDrive and SharePoint content from an email carrying hidden instructions, with no user interaction, using the model as the channel. Microsoft fixed it server side and reports no observed exploitation. Two requirements remain: the user's own permissions reapplied at the data layer, which Anthropic recommends obtaining through OAuth on each MCP server, and an exportable tool call log. No text mandates that log here: Article 50 of the European AI regulation, enforceable since August 2, 2026, requires telling people they are interacting with an AI and marking synthetic content, and the record keeping obligation of Article 12 covers only high-risk systems. The log is a purchasing requirement, not a legal obligation.

The criterion that survives when the other five change their answer

These five questions produce a snapshot, and three answers changed in the first half of 2026: retention at Anthropic, default routing at Microsoft, and the public availability of subprocessor lists. The legal foundation is itself stable in law and contested in fact: adequacy decision (EU) 2023/1795 is in force, upheld by the General Court of the European Union on September 3, 2025, but the United States Supreme Court ruled on June 29, 2026 that "for cause" protections for FTC commissioners are unconstitutional, and the European Data Protection Board asked the Commission for an assessment on July 31, 2026.

The only criterion that survives this uncertainty is the cost of leaving. The Data Act chapter on switching providers, applicable since September 12, 2025, imposes a notice period of two months maximum, a transition of 30 calendar days and a ban on charging for the switch as of January 12, 2027. Functional equivalence, however, binds only infrastructure providers, and Article 20 of the GDPR covers neither scoring nor pipeline history.

The real cost is measured on a public case: launched by the decree of October 9, 2020, the migration of the French health data platform was awarded to Scaleway on April 23, 2026, five and a half years after the decision.

Six questions, six proofs, three levels

Each section produces one question, and each one is graded: a criterion nobody meets stops sorting and starts moralizing.

• The map: since residency covers only one state out of six, which entities touch the data during one agent run, and which one performs the inference. Control DSP-19 of the Cloud Controls Matrix already requires documenting the physical locations of data, including where it is processed and backed up.
• The constraint: what the provider does when facing a foreign legal order. Promising to refuse is worth nothing, being required to challenge, notify and minimize can be verified.
• The list: is it dated, versioned, public, and does it name the model layer and the network layer.
• The matrix: per endpoint, which region processes, which region stores, which retention applies, and where you leave the negotiated regime without any alert.
• Authorization and trace: do the user's permissions apply at the data layer, and is the tool call log exportable and tied to an identity.
• The exit: in how many days is the full export delivered, in what format, what does it contain beyond the data the person provided, and does it become free of charge on January 12, 2027.

Three levels are enough to sort vendors. Top level: a dated public document. Middle level: a written, named answer. Bottom level: nothing in writing. In August 2026, the top level assumes documents that 63.6% of vendors promoting AI do not publish, young AI-native ones included.

Six questions and not 261 like the CAIQ, because the Sapio Research study for Vanta from July 2025, run with 3,500 executives across five countries, measures 9 weeks of work a year spent on vendor reviews, against 7 in 2024. The January 2026 CESIN barometer and the American HECVAT, which added an AI governance domain in February 2025, show that the question is asked on both sides of the Atlantic.

Ask for the map and the exit quote, not the flag

At the end of these six questions, "where is my data" has received six answers, and only one is about a country. The market, for its part, has already settled this in practice: IDC measures in 2025 that 40% of European organizations use a sovereign cloud offering, and that only 4% are considering leaving the global providers. The question is no longer which side to pick, it is what can be proven. Two artifacts replace the checkbox: the log of what the agent did with your data yesterday, tool call by tool call, and the exit quote.

Kasar is an AI-native CRM whose agent is called Leo. It captures interactions across email, LinkedIn, WhatsApp, calendar and calls, and it exposes an MCP server: these are the objects that questions 1, 4 and 5 probe, and the grid applies to us as much as to anyone else. A vendor that stops at "our servers are in Europe" has described only the state where nobody reads the data. Nothing requires taking our word for it before asking for that log and attempting an export. The Kasar trial runs 14 days.