# NDR with EU data residency

> Where NetSenX stores and processes network data: database in Ireland, API in Frankfurt and Paris, sub-processors and transfers stated plainly.

Source page: https://netsenx.com/en/eu-data-residency

Last reviewed: November 6, 2026

EU data residency means that the data a service stores and processes is kept in EU member states. For network detection and response (NDR), that data is metadata about the hosts on your network and the people using them, which GDPR can treat as personal data, so where it is kept is part of choosing the tool.

## The fact to plan around

On 16 July 2020 the Court of Justice of the EU (Case C-311/18, “Schrems II”) invalidated the EU–US Privacy Shield adequacy decision. Transfers of personal data to the United States then had to rely on other mechanisms of Chapter V of the GDPR, such as Standard Contractual Clauses, until the Commission adopted the EU–US Data Privacy Framework adequacy decision on 10 July 2023.

Source: [Court of Justice of the EU, Case C-311/18 (Schrems II), judgment of 16 July 2020 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311)

## What NetSenX does today

- Stores customer data in the EU: the database in Ireland (AWS eu-west-1), the API in Frankfurt (Germany) and Paris (France).
- Analyses network metadata and never decrypts encrypted traffic, so no decrypted content reaches the service.
- Publishes a data processing agreement under GDPR Article 28 with the full sub-processor list, each with its location and transfer safeguard; the DPO is reachable at dpo@netsenx.com.
- Is built and operated by TriStiX S.L., a company based in Alicante, Spain; an on-premises deployment is available on the Enterprise plan.

## What NetSenX does not do

Data residency is not the same as no transfer. Several NetSenX sub-processors are US-incorporated companies, and Cloudflare handles requests at the edge location nearest the visitor, so personal data can be accessed from, or pass through, countries outside the EEA; those transfers rely on Standard Contractual Clauses or the EU–US Data Privacy Framework. Payment and e-mail sub-processors operate under Standard Contractual Clauses, and some AI Analyst capabilities use a provider outside the EU only with your explicit consent.

## Questions buyers ask

### Where does NetSenX store customer data?

In the EU: the database in Ireland (AWS eu-west-1) and the API in Frankfurt (Germany) and Paris (France). The data processing agreement lists every sub-processor with its location and transfer safeguard.

### Does any data leave the EU?

It can. Several sub-processors are US-incorporated companies and Cloudflare serves requests at the edge location nearest the visitor, so personal data can be accessed from, or pass through, countries outside the EEA, under Standard Contractual Clauses or the EU–US Data Privacy Framework. Some AI Analyst capabilities use a provider outside the EU, and only with your explicit consent.

### Is EU data residency enough for GDPR?

No. Residency is one factor; GDPR is assessed for your processing as a whole, including the legal basis, data minimisation, retention and the processor's contract. NetSenX publishes its Article 28 data processing agreement and does not claim a GDPR certificate.

### Can NetSenX run on-premises?

Yes, on the Enterprise plan. The other plans use the dashboard hosted in the EU, with one agent on a SPAN or TAP port per network segment or on the hosts you choose.

## Sources

- [Court of Justice of the EU, Case C-311/18 (Schrems II), judgment of 16 July 2020 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311)
- [Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU-US Data Privacy Framework) — EUR-Lex](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj)
- [Regulation (EU) 2016/679 (GDPR), Chapter V (Articles 44-50) — EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

This page is general information, not legal advice. Check your obligations with your national authority or legal counsel.

## Related pages

- [Data processing agreement](https://netsenx.com/en/dpa)
- [Compliance](https://netsenx.com/en/compliance)
- [Encrypted traffic analysis](https://netsenx.com/en/encrypted-traffic-analysis)
- [NetSenX as a Darktrace alternative](https://netsenx.com/en/compare/darktrace-alternative)
- [Shadow AI on your network](https://netsenx.com/en/shadow-ai-detection)