# Data residency and trust (FAQ)

> 20 questions on Data residency and trust, in plain language: what to check, what NetSenX shows and what a sensor cannot see.

Source page: https://netsenx.com/en/faq/residency

## How does NetSenX handle GDPR, and where is my data stored?

Customer data is stored in the EU: the database in Ireland (AWS eu-west-1) and the API in Frankfurt (Germany) and Paris (France). NetSenX analyses network metadata and never decrypts encrypted traffic; a data processing agreement under GDPR Article 28 and the sub-processor list are published, and the DPO is reachable at dpo@netsenx.com. Payment and e-mail sub-processors operate under EU Standard Contractual Clauses, and some AI Analyst capabilities use a provider outside the EU only with your explicit consent. GDPR is assessed for your processing as a whole, so we do not claim a certificate for it.

https://netsenx.com/en/faq/how-does-netsenx-handle-gdpr-and-where-is-my-data-stored

## Where is my data stored?

Customer telemetry and alerts are stored exclusively in the EU — EU-region object storage and EU-region Postgres, encrypted at rest with AES-256-GCM. Stripe (payments) processes data in the USA, and several of our providers are US-incorporated; both are covered by EU Standard Contractual Clauses. Some AI Analyst capabilities may use a provider outside the EU only with your explicit consent. A full sub-processor list is published with our DPA.

https://netsenx.com/en/faq/where-is-my-data-stored

## Can I bring my own encryption keys (BYOK)?

On Business and Enterprise tiers, you can register an AWS KMS or HashiCorp Vault key with your tenant through our BYOK API.

https://netsenx.com/en/faq/can-i-bring-my-own-encryption-keys-byok

## Where does NetSenX store customer data?

In the EU: the database in Ireland (AWS eu-west-1) and the API in Frankfurt (Germany) and Paris (France). The data processing agreement lists every sub-processor with its location and transfer safeguard.

https://netsenx.com/en/faq/where-does-netsenx-store-customer-data

## Does any data leave the EU?

It can. Several sub-processors are US-incorporated companies and Cloudflare serves requests at the edge location nearest the visitor, so personal data can be accessed from, or pass through, countries outside the EEA, under Standard Contractual Clauses or the EU–US Data Privacy Framework. Some AI Analyst capabilities use a provider outside the EU, and only with your explicit consent.

https://netsenx.com/en/faq/does-any-data-leave-the-eu

## Is EU data residency enough for GDPR?

No. Residency is one factor; GDPR is assessed for your processing as a whole, including the legal basis, data minimisation, retention and the processor's contract. NetSenX publishes its Article 28 data processing agreement and does not claim a GDPR certificate.

https://netsenx.com/en/faq/is-eu-data-residency-enough-for-gdpr

## Can NetSenX run on-premises?

Yes, on the Enterprise plan. The other plans use the dashboard hosted in the EU, with one agent on a SPAN or TAP port per network segment or on the hosts you choose.

https://netsenx.com/en/faq/can-netsenx-run-on-premises

## Is an EU region of a US cloud provider enough for data residency?

Storing data in an EU region keeps it physically in the EU, but a provider incorporated in the US may be subject to US law that reaches data it controls. Under Chapter V of the GDPR, transfers outside the EU need a legal basis such as the EU-US Data Privacy Framework or standard contractual clauses. Ask each vendor where data is stored, who can access it and which sub-processors are involved. NetSenX publishes its sub-processor list in its data processing agreement.

https://netsenx.com/en/faq/is-an-eu-region-of-a-us-cloud-enough-for-data-residency

## Does a network sensor send packet contents to the cloud?

That depends on the product, so ask each vendor exactly what leaves your network, in what form and where it is stored. Some tools copy full packets for later analysis, others send only summaries of each connection. NetSenX analyses metadata and a few protocol fields, such as timing, volume, destinations, DNS answers and the TLS handshake, and never decrypts encrypted traffic. It does not upload file contents, e-mail text or what someone typed into a website. Customer data is stored in the EU, with the database in Ireland and the API in Frankfurt and Paris, and an on-premises option is available on the Enterprise plan for organisations that want nothing to leave their premises. Metadata can still identify a device and, through it, sometimes a person, so it is personal data under the GDPR: the data processing agreement sets out how it is handled.

https://netsenx.com/en/faq/does-a-network-sensor-send-packet-contents-to-the-cloud

## Can I get my data out when leaving a security vendor?

You should be able to, but check before you buy, because the contract decides how easy it is. Ask which data you can export (alerts, device lists, reports, configuration), in which format, whether export costs extra, how long you keep access after notice, and when the vendor deletes the data and confirms it. Under the GDPR, a processor must return or delete personal data at the end of the service, as the data processing agreement sets out, and you choose which. Plan the exit at the start: keep your own archive of anything you may need later, such as evidence for an audit or an insurance claim, rather than relying on the vendor’s retention. With NetSenX, alerts can be exported through the API from the Pro plan and sent to a SIEM from the Business plan, PDF compliance reports are available from the Starter plan, and the data processing agreement is published on the website.

https://netsenx.com/en/faq/can-i-get-my-data-out-when-leaving-a-security-vendor

## What is the difference between data residency and data sovereignty?

Data residency is about where data is stored and processed; data sovereignty is about whose law and whose control the data is subject to. They are often confused because storing data in Frankfurt sounds like keeping it under European law. It does not necessarily: a provider headquartered outside the EU may be obliged by its home country’s law to hand over data it controls, wherever the server stands. Residency is easy to check on a map; sovereignty requires looking at the company that operates the service, its parent company, its sub-processors and who holds the encryption keys. For each vendor ask three questions: where is the data, who can be legally compelled to disclose it, and who can technically read it. NetSenX stores customer data in the EU, with the database in Ireland and the API in Frankfurt and Paris, and lists its sub-processors, some of them US-incorporated, in the data processing agreement. For full control, an on-premises option is available on the Enterprise plan.

https://netsenx.com/en/faq/data-residency-vs-data-sovereignty

## After the Schrems II ruling, can we still use security tools from US companies?

Yes, but you need a valid basis for any transfer of personal data and should know what that basis is for each tool. In Schrems II, the Court of Justice of the EU struck down the Privacy Shield in 2020 and required exporters relying on standard contractual clauses to assess whether the law of the destination country undermines them, adding safeguards where needed. Today a transfer to the US can rely on the EU-US Data Privacy Framework if the recipient takes part in it, or on standard contractual clauses with a transfer impact assessment. Security tools often process IP addresses, device names and user names, which are personal data. For each tool, find out where data goes, which legal basis the vendor uses, whether the company takes part in the Framework, and how you would replace it if that basis fell away again. NetSenX stores customer data in the EU. Its data processing agreement lists the sub-processors and states plainly that some are established outside the EEA, for example US-incorporated companies, and that those transfers rely on standard contractual clauses or the Data Privacy Framework.

https://netsenx.com/en/faq/after-schrems-ii-can-we-use-us-security-tools

## Do a vendor’s data residency promises also cover logs, backups and support data?

Not always, so ask about each kind of data separately. A vendor may keep your main database in the EU while backups, error reports, support tickets, analytics, e-mail delivery or the staff who answer your tickets sit elsewhere. Each of those can contain personal data or details of your network, such as IP addresses, device names or screenshots. Ask the vendor for a list of data categories with the location and the sub-processor for each, and check that the data processing agreement covers all of them, not only “customer data” in the narrow sense. Also ask where staff with administrative access are based, since remote access from outside the EU can be a transfer too. For NetSenX, customer data is stored in the EU, with the database in Ireland and the API in Frankfurt and Paris, and the sub-processors are listed in the data processing agreement. That list is the place to check where each service runs; if anything is unclear, ask us before you sign.

https://netsenx.com/en/faq/are-admin-and-audit-logs-covered-by-residency-promises

## Which questions should we ask a security vendor about its sub-processors?

Ask who they are, what each one does with your data, where it does it, and how you will hear about changes. A sub-processor is a company the vendor uses to process your personal data, such as a hosting provider, a database service or an e-mail delivery service. Under the GDPR, a processor may engage one only with the controller’s prior authorisation, specific or general, and must flow the same data protection obligations down to it. Practical questions: Is the full list published, with location and purpose for each entry? How much notice do you get before a new one is added, and can you object? Which of them can see readable data, and which only hold encrypted data? Are any outside the EU, and on which transfer basis? Who is liable if a sub-processor fails? NetSenX lists its sub-processors in its data processing agreement, published on the website, so you can check them before you sign up.

https://netsenx.com/en/faq/which-questions-to-ask-a-security-vendor-about-sub-processors

## Does a network monitoring service need a data processing agreement?

Yes, if the provider processes personal data on your behalf, and network monitoring nearly always does. IP addresses, device names, user names in hostnames and connection times can identify a person directly or indirectly, so they count as personal data under the GDPR. When a vendor processes them for you, you are the controller and the vendor is the processor, and the GDPR requires a contract or other legal act that sets out the subject matter, duration, nature and purpose of the processing, the types of data, your instructions, security, sub-processors, assistance with breaches and what happens at the end. Read it like any other contract: check breach notification times, audit rights, sub-processor notice and deletion at the end. NetSenX’s data processing agreement is published on its website and forms part of the terms of service, so it applies from the moment you use the service; Enterprise customers who need a signed copy can request one.

https://netsenx.com/en/faq/does-network-monitoring-need-a-data-processing-agreement

## Is the NetSenX data processing agreement public, and what does it commit to?

Yes, it is published on the website, so you can read it before you sign up. It forms part of the NetSenX terms of service between TriStiX S.L. as processor and your organisation as controller, and it lists the sub-processors with their role and location. Among its commitments: NetSenX notifies you of a personal data breach within 24 hours of becoming aware of it; changes to the sub-processor list are announced at least 14 days in advance, so you can object; you have audit rights on notice; and when you close your account, personal data is deleted immediately and backup copies expire within 14 days, after you have had the chance to export it. It also states that personal data is stored in the EEA and that some sub-processors are established outside it, with the transfer safeguards used. The DPA is governed by Spanish law, and the supervisory authority it names is the Spanish AEPD. Have your DPO compare it with your own requirements; Enterprise customers can request a signed copy.

https://netsenx.com/en/faq/is-the-netsenx-dpa-public

## Where does NetSenX store data about our employees’ devices, and for how long?

In the EU, and for as long as your plan’s alert history allows. NetSenX records connection metadata from the monitored segments: internal and external IP addresses, ports, times, data volumes, the server names devices contact, and the name a device announces on the network, which is sometimes a person’s name. That data is stored with the database in Ireland and the API in Frankfurt and Paris. Alerts are kept for your plan’s alert history: 30 days on Free, longer on paid plans and unlimited on Enterprise. NetSenX does not record message content, files or what someone typed, because it never decrypts traffic, and it reports AI use per device and program, not per person. Even so, device data can point to an employee, so treat it as personal data: tell staff in your privacy notice what is monitored and why, limit who in your company can open the account, and check whether national law gives a works council a say. On Enterprise, the data can stay on your premises.

https://netsenx.com/en/faq/where-does-netsenx-store-data-about-employees-devices

## Do we need a data protection impact assessment before deploying network monitoring?

Possibly, and it is worth doing a short one even when it is not strictly required. The GDPR requires a data protection impact assessment (DPIA) where processing is likely to result in a high risk to people’s rights, and it names systematic monitoring among the cases to consider; national data protection authorities also publish lists of processing that always needs one. Monitoring a company network can fall into that area, especially where it covers employees’ devices or reaches personal use. A DPIA describes what you collect and why, checks that it is necessary and proportionate, lists the risks to the people concerned and the measures that reduce them, and records the decision. Ask your data protection officer, check your authority’s list and keep the result. Measures that help in your assessment: NetSenX records metadata rather than content, never decrypts traffic, reports AI use per device and program rather than per person, keeps data in the EU, and lets you limit who can open the account. It does not write the DPIA for you.

https://netsenx.com/en/faq/do-we-need-a-dpia-before-deploying-network-monitoring

## Is a smaller European security vendor a business continuity risk?

It can be, as any vendor can, so judge it by the exit plan rather than by size alone. A small vendor may be more exposed to funding, staffing or acquisition changes; a large one may change prices, drop a product or move data under another jurisdiction. Reduce the risk the same way in both cases: make sure you can export your data in a usable format at any time, keep your own copies of evidence you need for audits, insurance or regulators, know how long the vendor keeps running after notice, and decide in advance what you would replace it with. For a detection tool, also consider what happens if it stops: alerts stop, but your systems keep working, which is different from losing a firewall. NetSenX is operated by TriStiX S.L., a small company in Spain, and we say so openly. Its data processing agreement describes export and deletion; alerts can be exported through the API from the Pro plan and to a SIEM from the Business plan, and Enterprise can run on your own premises.

https://netsenx.com/en/faq/is-a-smaller-eu-vendor-a-continuity-risk

## What is the US CLOUD Act, and does it affect data stored in the EU?

It is a US law, and yes, it can reach data stored in the EU. With a warrant or similar order, US authorities can require service providers under US jurisdiction to disclose data in their possession, custody or control, even when it is stored outside the US. That is why storing data in an EU data centre does not by itself settle the question: what matters is whether the company that controls the data, or its parent, is subject to US jurisdiction. Providers can challenge some orders, and EU law limits when a European company may hand data to a foreign authority, so the result is a legal conflict rather than automatic access. Encryption with keys the provider cannot use reduces what could be disclosed. For each vendor, ask who controls the data and its keys and which companies in the chain are US-based. NetSenX is operated by a Spanish company and stores customer data in the EU, but its data processing agreement lists some US-incorporated sub-processors. If you need to rule that out entirely, the on-premises option on the Enterprise plan keeps the data on your own systems.

https://netsenx.com/en/faq/what-is-the-us-cloud-act-and-does-it-affect-eu-data

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: https://netsenx.com/en/faq