How does data residency work?
Cloud services run in named regions, such as London or Frankfurt, and many let customers choose where their data is stored. A residency commitment usually covers data at rest, in databases and backups. It’s harder to promise for data in use, because processing can happen elsewhere, in a model provider’s data centre, a support tool or an email service.
Data protection law rarely demands residency. The UK GDPR and the EU GDPR allow personal data to leave the UK or the EU, but they restrict those transfers: each needs an adequacy decision for the destination, appropriate safeguards such as standard contractual clauses, or a specific exception.
The European Commission recognises the UK as adequate and renewed that decision in December 2025, so personal data can flow from the EU to the UK without extra safeguards.
For example, a UK company might require customer records to be stored in the UK, accept processing in the EU and put safeguards in place for any service that processes data in the United States.
Why does data residency matter for a website voice agent?
A voice agent sends live audio to a speech or language model, saves transcripts in a database and sends emails, and each step can run in a different region. A vendor that stores transcripts in your region may still process the conversation somewhere else.
Ask where each step happens, not only where the database is, and check that your privacy notice and transfer safeguards cover them.
Where Kawl Now stores and processes data
Kawl Now stores conversation data in a Postgres database on Supabase in London. The application runs on Railway in its EU West region, and sign-in and notification emails are sent through Resend.
During a call, audio passes directly between the caller’s browser and OpenAI, which processes the voice conversation. OpenAI also analyses callers’ words from recent calls for automatic insights, and writes and voices any handover briefing. Its processing region isn’t documented, so Kawl Now doesn’t claim that all data stays in the UK or EU.
If you use human handover, an early release, Twilio verifies your team’s phone number and connects the call to your team. Kawl Now uses Twilio’s default region, the United States, for this.
You can’t choose a region for your workspace. No call audio is recorded. What’s stored is mainly text: transcripts, knowledge, feedback, usage records and insight reports, plus your team’s verified phone numbers and each handover’s caller name and briefing if you use handover.
Common questions
Is data residency the same as data sovereignty?
No. Data residency is where data is stored and processed. Data sovereignty is the idea that data is subject to the laws of the country where it’s held, so choosing a location also brings that country’s laws with it.
Can a SaaS vendor guarantee UK data residency?
Only for the parts it controls. A vendor can keep its database in the UK, but other services it uses, such as an AI model provider, may process data elsewhere. Ask where every step runs and which safeguards cover any transfer.