EU hosting makes the difference in AI-assisted call answering because it narrows the legally most difficult question in the GDPR, the transfer of data to third countries, down to a few clearly identifiable points. If calls, transcripts and customer data are hosted and stored in data centers inside the EU, standard contractual clauses and transfer impact assessments are only needed for the individual processing steps that actually take place outside the EU, and those can be checked one by one. The moment an AI answers your calls, it processes personal data: names, callback numbers, the substance of requests, and at a law firm quickly confidential client information as well. Data protection is therefore not an optional extra but the foundation. Loomira is an AI phone assistant for small and mid-size businesses that answers calls around the clock and handles requests in a structured way, hosted in the EU (AWS Frankfurt), with GDPR data protection as an architectural principle. This article explains why the server location is so decisive, which further building blocks are mandatory, and how to recognize a trustworthy provider.

What exactly does EU hosting mean for a phone assistant?

EU hosting means that a provider runs its application in data centers inside the European Union and stores the data there as well: transcripts, call logs and customer data. For a phone assistant that is the necessary foundation, but it does not answer every question. Call handling, speech recognition, the language model and speech synthesis usually run through specialized sub-processors, and each of them may process data in a different place. A reliable picture only emerges from four facts: where the data is hosted and stored, which sub-processors handle which steps and where, which safeguards cover any third-country step, and which data each step actually receives. The last point deserves attention. Whether a service processes the caller's voice or only a short response text makes a considerable difference to the risk.

At Loomira this looks as follows. The application and the database run in the AWS eu-central-1 region in Frankfurt; calls, transcripts and customer data are hosted and stored in the EU, and call audio is not stored. Telephony, speech recognition and the language model use EU locations or EU endpoints. The one exception is speech synthesis: it currently uses a global endpoint, where processing may also take place in the USA. That step is covered by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), and only the response text the assistant speaks is sent, not the caller's voice. A switch to an EU endpoint is planned. Every service, with its location and transfer safeguard, is listed in our public list of sub-processors. This disclosure is deliberate: a provider that describes its data flow precisely gives you something you can verify.

What does the GDPR say about data transfers outside the EU?

The GDPR permits transfers of personal data to third countries only under additional conditions (Chapter V, Art. 44 et seq.): either an adequacy decision by the European Commission for the destination country, or appropriate safeguards such as standard contractual clauses, whose effectiveness the controller may have to assess and document itself. The legal history of the past decade shows how fragile such constructions can be. The Court of Justice of the EU declared the Safe Harbour adequacy decision invalid in October 2015 and its successor, the EU-US Privacy Shield, in July 2020, and with each change the assessment work started over.

For a small business the decisive argument is therefore pragmatic. Every third-country transfer means assessment effort and documentation duties, and as the controller you need to be able to follow your provider's chain. The more data is hosted and stored in the EU, and the less a third-country step receives, the smaller that effort becomes. So do not only ask whether there is a third-country transfer, but also: on what basis (an adequacy decision or standard contractual clauses), with which transfer impact assessment, and which data exactly leaves the EU in the process?

Which three building blocks are mandatory besides hosting?

A provider that answers calls for you is your processor. Three points follow from that, and they must be in place regardless of server location:

1. Data processing agreement (DPA)

Under Art. 28 GDPR you conclude a DPA with the provider. It governs which data is processed for what purpose, which technical and organizational measures apply, and how sub-processors are handled. Without a DPA the use is simply not compliant. Ask for it before the first real call.

2. The disclosed chain of sub-processors

A phone assistant usually relies on further services for speech recognition, speech synthesis and the language model. Each of these services potentially processes your callers' data. Serious providers disclose this chain completely, with the location and purpose of each service and, wherever a service processes outside the EU, the transfer safeguard. Ask for the list of sub-processors; it belongs to a proper DPA and is the fastest reality check for any "EU hosting" promise.

3. Transparency under Art. 50 of the EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) obliges providers and deployers to make it recognizable to people that they are interacting with an AI system; the transparency obligations of Art. 50 have applied since 2 August 2026, as the European Commission's guidance confirms. An assistant that identifies itself as an AI at the start of the conversation meets that requirement, and builds trust along the way. Hiding it helps nobody.

How much does data protection really weigh on small businesses?

Considerably, which is precisely why it pays to shift the burden to the provider. In Eurostat's 2025 enterprise survey, among EU enterprises that had considered AI but not adopted it, 53 percent cited a lack of clarity about the legal consequences and 49 percent concerns about data protection and privacy, second and third only to a lack of expertise. German data points the same way: in a Bitkom survey from September 2025, 97 percent of companies with 20 or more employees reported high data protection effort, and among those with 20 to 99 employees 45 percent rated it as very high, more than in any larger size class.

The consequence for choosing a provider: a service that brings EU hosting, a DPA and transparency as standard takes off your hands exactly the part of the data protection work that requires specialist knowledge. What remains with you, such as the privacy notice for callers, the provider should support with templates.

What does data minimization look like in practice?

Good data protection does not end at the server location; it shows in details. Are phone numbers stored only as long and as granularly as necessary, and hashed rather than kept in clear text where possible? Can call recording be switched off or based on consent? Are there defined, technically enforced deletion periods for transcripts and summaries? And does each service in the chain receive only the data it needs for its step? Such measures reduce the risk if something does go wrong: a data leak that affects only hashed numbers and long-deleted legacy data is a different event from one involving years of clear-text records. Loomira, for example, does not store call audio (the transcript is the record), stores caller numbers as salted hashes and anonymizes call data after a defined retention period.

Special care applies to professions bound by secrecy. For law firms, tax advisers and health professions, professional confidentiality rules under national law come on top of the GDPR (in Germany, for instance, § 203 of the Criminal Code makes breaching it a criminal offense). Here the provider must safeguard not just data protection but the confidential handling of client and patient information, technically and contractually. For health data, the stricter rules of Art. 9 GDPR for special categories apply in addition.

Is an EU data center alone enough?

No. The server location is necessary but not sufficient. Ask two further questions. First: which services actually access the data in operation? An EU data center does not tell you whether individual processing steps, speech recognition or speech synthesis for example, are passed to services outside the EU; what counts is the complete data flow, not only the location of the database. Second: under which jurisdiction do the companies involved operate? Server location and corporate seat are two different questions, and both belong in the assessment. The answer is in the sub-processor list of the DPA, not in the marketing copy.

In practice this means: have the data flow explained to you once in full, from the first ring to the stored summary. A provider that can describe this chain cleanly in five minutes has usually also built it cleanly. The questions to ask are collected in our overview of the AI phone assistant.

Why is caution warranted with certification claims?

Be skeptical when a young provider advertises ISO 27001 or SOC 2 seals it does not (yet) hold, or "GDPR-certified", a term rarely backed by a recognized certification procedure. More honest is a statement of which measures apply concretely today and what is on the roadmap. Loomira makes no certification promises it has not fulfilled; the measures actually implemented are documented in the data protection overview. What can be verified in the end is not the seal but the substance: server location, sub-processor list, deletion concept.

How do you recognize a trustworthy provider?

  • It names the server location concretely (EU region) instead of vaguely "secure" or "cloud-based".
  • It provides a DPA and discloses the complete list of sub-processors, with locations and, where needed, transfer safeguards.
  • The assistant identifies itself as an AI in the conversation, audibly, not in the fine print.
  • It answers questions about audio storage, number hashing and deletion periods in writing and concretely.
  • It promises no certificates it does not hold.

Conclusion

GDPR-compliant call answering is achievable, but only if data protection is built in from the start. EU hosting is the single most effective lever because the stored data sits in the EU and the third-country question narrows to individual processing steps you can check; the DPA, the disclosed provider chain with its transfer safeguards and AI transparency then make the deployment robust. Check these points before you start. A provider that answers them clearly takes the work off your hands, not the control over your data.