Data residency vs. sub-processors
Why both matter for an EU clinic's DPIA — and how to ask the right questions.
IT / SecurityClinic owner· 5 min · Updated 19 Apr 2026
In plain language
Data residency is where the data is stored. A sub-processor is a third party the vendor uses to process data (a cloud provider, an AI inference provider, a transcription service). Both have to satisfy a DPIA.
Why it matters
EU residency without a sub-processor list is incomplete. Data can be physically stored in Frankfurt and still flow to a US-based AI inference endpoint mid-request — and the DPIA needs to capture that.
Faurenis's approach
Faurenis maintains a sub-processor list on the Trust Centre. Every sub-processor is listed with the data it touches, the region it operates in, and the contractual basis (SCCs, BAA, or equivalent).
Risks & safeguards
- Sub-processor changes — Faurenis commits to 30 days notice before adding or replacing a sub-processor.