"Is customer data hosted in the EU?" is the first checkbox on most security questionnaires, and it is the wrong place to stop. A vendor can tick yes and still hand your DPO a stack where the real transfers happen somewhere else: in a pixel on your landing page, in an email open tracker, or in a conversion call to an ad platform.
This post separates the layers. It covers what the law asks, where marketing stacks actually send EU data, what server-side forwarding does and does not change, and the eight written answers worth requiring before you sign. It is written for the marketer who has to sit across from a DPO, not for the lawyer. The article-by-article processor view lives in GDPR for URL shorteners.
Short answer: residency is a property of each layer
- "EU-hosted" describes where a vendor's own servers sit. It says nothing about the browser scripts, email trackers and ad-platform calls attached to your campaigns.
- Server-side conversion forwarding gives you control over the transfer. It does not remove it. If the ad platform is outside the EEA, you still need a transfer mechanism.
- A short, public sub-processor list with named locations is auditable. A long one with vague entries is a standing review cost.
- Ask for the eight written answers in the checklist below on the first call. Vendors that have them ready usually clear review in days, not weeks.
What the law actually requires
Four pieces of law do most of the work.
Primary texts are on EUR-Lex; the EUR-Lex page returned no content to an automated fetch on 2026-10-24, so the article references below are to the Regulation's published numbering and you should read the text there directly.
Article 3(2), territorial scope. The GDPR applies to a controller or processor outside the EU when processing relates to offering goods or services to people in the EU, or to monitoring their behaviour in the EU. Click tracking on EU visitors is monitoring. The text is in Regulation (EU) 2016/679 (accessed 2026-10-24, page did not load for our fetch).
Article 28, processors. Each vendor that handles personal data for you needs a contract covering the Article 28(3) terms. Article 28(2) requires your prior authorisation, specific or general, before a processor engages another processor, and a general authorisation must give you the chance to object to changes. That is why the sub-processor list matters in practice.
Articles 44 to 49, transfers. Chapter V forbids moving personal data to a third country unless a listed route applies: an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or a narrow derogation. A related record-keeping duty sits in Article 30: your records of processing should name each transfer and its basis.
Schrems II and the DPF. In case C-311/18 the Court of Justice invalidated the Privacy Shield in July 2020 and held that SCC users must check whether the destination country's law undermines the clauses (judgment on Curia, accessed 2026-10-24, page redirects to a script-driven viewer that did not render for our fetch). The Commission adopted a new US adequacy decision, the Data Privacy Framework (DPF), for certified recipients on 10 July 2023 (Commission page, accessed 2026-10-24). The General Court dismissed the Latombe challenge to it on 3 September 2025, and an appeal is pending at the Court of Justice as case C-703/25 P (Official Journal notice C/2025/6610, accessed 2026-10-24, summary taken from a search result because the page did not render). Check the Court register for current status. The EDPB's Recommendations 01/2020 on supplementary measures (final version adopted 18 June 2021, accessed 2026-10-24) remain the reference for teams that want a transfer regime that survives a change in the legal climate.
Where marketing stacks send EU data
The gap between "our shortener is EU-hosted" and "our data stays in the EU" opens in the layers around the shortener. Rather than guess at vendor defaults, which change, here is the pattern and the question to put to each owner.
| Layer | What moves | Question for the owner |
|---|---|---|
| Browser pixels and tags (Meta, Google, others) | Page URL with UTM parameters, IP, cookie IDs, sent from the visitor's browser to the vendor | Which vendor endpoint, which transfer basis, and is consent collected first? |
| Email open and click trackers | Subscriber identifier in the tracking URL, hosted on the email provider's CDN | Which region is our account on, and does the tracking domain follow it? |
| CRM and marketing automation | Contact records and form submissions | Which data region is our tenant in, and can it be changed after the fact? |
| Server-side forwards | Click or conversion events sent from a server you operate | Is the receiving endpoint inside the EEA, and what identifiers are sent? |
| The shortener | Redirect request and click log | Where are the redirect and the click record processed and stored? |
Most teams I see run several of these at once with no transfer assessment on file and a records entry that says "Google Analytics, Meta Pixel" without naming a mechanism. The shortener is usually the smallest item on the list, because a redirect lasts a few milliseconds and the click log is the only record it creates. The browser-side items are the ones that fire before any EU server sees the request. The practical consequences of those are covered in Schrems II and tracking pixels, and consent handling for short links is in cookie consent for short links.
What server-side forwarding changes, and what it does not
In a server-side setup the visitor's browser only talks to the redirect. A server then sends the conversion event to the ad platform's API, such as the Meta Conversions API or the Google Analytics 4 Measurement Protocol (both pages accessed 2026-10-24; Meta's page is a script-rendered doc site, so rely on its current text rather than this summary).
What changes. The transfer now happens on infrastructure you configure, with fields you choose, instead of in a script you cannot easily audit. Your records entry can describe one controlled server-to-server transfer rather than "browser-originated, basis to be confirmed".
What does not change. If the receiving endpoint is outside the EEA, a transfer still takes place. You still need SCCs or a Data Privacy Framework route for that leg and a record of it. Server-side forwarding improves control and data minimisation. It is not an exemption, and your DPO should hear that before the review, not after.
As for Elido today, it can forward link clicks server-side to Google Analytics 4 (Measurement Protocol), Mixpanel, Klaviyo, Brevo and Datadog. It does not forward to Meta or TikTok, and it does not forward purchases or conversions to any platform. I checked the forwarders in the code, and two details matter for a DPO. Mixpanel defaults to its US endpoint unless you set the project's region to EU or India, so set it to EU if your project lives there; the Mixpanel EU data residency guide walks through it. Failed deliveries are retried once after a second and then dropped, so treat forwarded events as best effort, not as a ledger. Event deduplication IDs and identifier hashing are not implemented yet.
Why the sub-processor list is the artefact to read
Under Article 28(2) a processor must not add sub-processors without your authorisation, and a general authorisation must let you object to additions. In practice this becomes a public list plus a notice period. A usable list names the vendor, what it does, and where the data is processed at the level of country or cloud region, and it says how changes are announced.
Elido's list is at /legal/subprocessors. It currently names 13 vendors, each with a purpose and a location. Several are outside the EU or have a non-EU fallback, and the policy says so and relies on SCCs for those. Thirteen is not a tiny number, and I would rather you read it than take a count on trust: the useful test is whether you can review every row in an afternoon, with a location beside each one. The contract terms sit in the DPA, and the Elido privacy policy commits to 30 days of advance notice for list changes.
The eight written answers to ask for
Put these to any marketing vendor, in writing, before the review.
- Which hosting region holds new customer data, named to the data-centre region or at least the country? "The EU" alone is not an answer.
- Is that region fixed in the standard contract, or an operational choice the vendor can change without notice?
- Is a processor agreement covering Article 28(3) available pre-signed, before the sales call ends?
- How many sub-processors are in the standard chain, and where is each one processed? Is the list public and linkable from your records?
- Is conversion tracking forwarded server-side, and which identifiers are sent hashed and which in the clear?
- What happens to the visitor IP address in click logs: truncated, hashed, or stored as received, and for how long?
- How is a data subject erasure request carried out, and does it reach the click-event store?
- Which independent attestations does the vendor hold today, with dates, and which are planned only?
On question 6, Elido truncates the visitor IP at the edge (IPv4 to /24, IPv6 to /48) before the click is stored. Country, region, city and approximate coordinates are derived first and kept with the click, and the full user agent is stored, so treat the click row as personal data. On question 8, SOC 2 is in preparation with no report issued and Elido is not ISO 27001 certified, so neither is a held certificate. Business-plan customers can get a HIPAA BAA. Hold every vendor, including us, to the "held versus planned" distinction.
What Elido does and does not claim
Elido is the link layer. The privacy policy states that operational data is stored in EU data centres, with the primary database, analytics store and backups in the EU. The legal pages disclose redirect nodes in the US and Singapore that process visitor requests and may cache link data, and the click event produced there is still personal data processed at that location, so I will not claim that every click is processed only inside the EU.
Per-workspace region pinning, for example choosing a US-only or Asia-only data location, does not exist in Elido today. Do not accept contract wording that assumes it. The compliance solutions page summarises the current posture for buying teams.
If your policy is that no personal data about EU subjects may leave the EEA at all, a different shortener will not fix that. The fix is not sending conversion events to platforms outside the EEA.
That is a marketing decision, not a hosting one.
For the wider EU-versus-US vendor question see EU alternatives to US SaaS, and for the processor obligations see the GDPR for URL shorteners post linked at the top.
Related on the blog
Frequently asked questions
What does EU data residency mean for a marketing tool?
It means the vendor stores and processes your data in EU data centres. It does not mean no personal data ever leaves the EU. Pixels in the visitor's browser, server-side forwards to ad platforms and support tooling can each move data to a third country, and each needs its own transfer basis under Chapter V of the GDPR.
Is EU hosting enough to be GDPR compliant?
No. Hosting location is one input. You still need a processor agreement under Article 28, a lawful basis, a records entry under Article 30, and a transfer mechanism for any sub-processor or ad platform outside the EEA. EU hosting only shrinks the number of transfers you have to justify.
Does server-side tracking remove the need for transfer safeguards?
No. Moving a conversion call from the browser to a server changes who sends the data and what you control, but if the receiving platform is outside the EEA the transfer still happens. You still need SCCs or an adequacy route such as the Data Privacy Framework for that leg.
Is the EU-US Data Privacy Framework still valid?
Yes, as of 24 October 2026 the adequacy decision of 10 July 2023 stands. The General Court dismissed the Latombe challenge on 3 September 2025, but an appeal to the Court of Justice (C-703/25 P) is listed, so keep a fallback such as SCCs in your records.
How many sub-processors should a link shortener have?
There is no legal number. What matters is that the list is public, names each vendor with its purpose and location, and changes with advance notice. Elido publishes 13, each with a purpose and a location, and gives 30 days notice of changes.
Does Elido keep click data only in the EU?
Elido's privacy policy says operational data is stored in EU data centres, with a primary region in the EU. The legal pages also disclose redirect nodes in the US and Singapore that process visitor requests, so visitor IPs can be handled outside the EU. Server-side forwards you configure to ad platforms leave the EU by design.
Try Elido
Paste a URL, get a working short link
No signup. Link lives for 30 days. Sign up to keep it forever.
No signup needed. Sign up free for 50 links a month.