Your client's data protection policy says: 'Customer data must be processed within the European Economic Area.' Your PDF tool uploads files to AWS in Virginia. You have a problem.
What data residency is
Data residency is the physical location where data is stored and processed. Data sovereignty is the broader legal concept that data is subject to the laws of the country where it resides.
Many regulated industries and government contracts impose data residency requirements: data must stay in the UK, in the EEA, in Australia, in Switzerland. Schrems II made this stricter for EU personal data transferred to the US.
Where common PDF tools process
Adobe Acrobat online: US-based primarily, with some EU options on enterprise plans.
Smallpdf, iLovePDF, similar: usually US or EU depending on vendor location.
Microsoft 365 PDF features: regional data residency on enterprise plans.
For smaller tools, residency is often unclear — they use AWS/GCP/Azure without specifying region. Read the privacy policy or ask procurement.
Browser-side tools and residency
A tool that processes in your browser doesn't transfer your data anywhere. The data is on your device, in your jurisdiction, subject to your local law.
This is the cleanest way to satisfy data residency. Flint processes in your browser; your file content doesn't reach Flint's servers, so no cross-jurisdictional transfer happens.
For data residency obligations, browser-side tools are usually the simplest answer.
When server-side is unavoidable
Some operations genuinely need server power — heavy OCR, certain conversions, very large files. For those, pick a vendor offering processing in your required region. Most major vendors offer this on enterprise plans.
Verify residency claims with contractual commitments. 'Data may transfer to other regions for processing' clauses in privacy policies can undermine residency promises.
FAQ
Does Schrems II ban US-based tools for EU data?
Not ban — but requires Standard Contractual Clauses plus a transfer impact assessment. Many EU customers prefer in-region or browser-side tools to avoid the analysis.
What about UK data after Brexit?
UK has its own GDPR and adequacy decisions with the EU. US transfers under SCCs work for UK data similarly to EU.
Does Flint have a specific data residency?
Flint processes in your browser — your data doesn't transit Flint's infrastructure for processing, regardless of where Flint's servers are.
Do I need to document data residency for clients?
Yes, in DPAs and supplier inventories. Clients with regulated industries often audit residency claims.
Data residency is a constraint that browser-side tools usually solve. Flint stays on your device — wherever that is.