← All posts

CSP reporting and EU data residency: where each service keeps your reports

CentralCSP Team

CentralCSP ·

Sooner or later someone asks where your CSP reports go. It might be your DPO filling in the record of processing, a procurement team working through a DORA register of information, or a security lead writing a NIS2 supplier policy. The answer is rarely "the vendor's website says EU". Reports pass through an edge network, land in a database, get copied to backups and sometimes reach an alert channel, and each step can sit in a different country.

This post explains what to look at, compares what CSP reporting services published about it in early November 2026, and ends with a checklist you can send to any vendor, us included.

CentralCSP stores reports in France. Every statement about another vendor links to the page it comes from. If you want to test CentralCSP first, CentralCSP monitoring takes one header and the Start plan has a 14-day free trial.

Why report location is a real question

Reports contain personal data

A CSP violation report carries the URL of the page, the referrer, the blocked URL and, with the Reporting API, the browser's user agent (W3C Reporting API). The browser removes fragments and credentials from URLs but keeps the query string (CSP Level 3). Add the IP address the report arrives from, and you have data that can relate to an identifiable person. The GDPR names IP addresses among the online identifiers that can identify people (Recital 30), and the Court of Justice held in Breyer (C-582/14, 19 October 2016) that a dynamic IP address can be personal data for a website operator (judgment). The personal data in CSP reports post goes field by field.

So a reporting service is a processor under GDPR, and where it processes data falls under the transfer rules of Chapter V (Article 44).

DORA asks for the location in the contract and the register

For EU financial entities, DORA Article 30(2)(b) requires ICT contracts to state "the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location", and the provider must give advance notice before changing them. Article 28(3) requires a register of information covering all ICT contracts. The register templates in Implementing Regulation (EU) 2024/2956 include the country of the data at rest (field B_02.02.0150), required when a service supporting a critical or important function stores data, and the country where data is processed (B_02.02.0160), required whenever the service processes data.

A CSP reporting tool on a banking site will usually not support a critical function. It still sits in the register, where the processing country is required anyway, and your procurement team will ask for it.

NIS2 asks about suppliers, not residency

NIS2 does not require data to stay in the EU. Article 21(2)(d) requires "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers", and Article 21(3) asks entities to consider each supplier's vulnerabilities and practices. For digital providers covered by Implementing Regulation (EU) 2024/2690 (cloud, CDN, managed security, online marketplaces and others), the annex adds a supply chain policy with selection criteria (point 5.1) and a directory of suppliers (point 5.2). Where a supplier processes data is one of the facts that assessment uses. The NIS2 and DORA third-party scripts post covers the wider picture.

Residency, transfer and jurisdiction are three questions

Vendors often answer one and imply the other two.

  • Residency: where the data is stored at rest, backups included.
  • Processing path: where it travels before storage. Most report endpoints sit behind a CDN or edge network, which sees the IP address and the full payload. An EU database behind a global edge still processes data at the edge.
  • Jurisdiction: which country's law governs the provider and its sub-processors. Data stored in an EU region by a company headquartered elsewhere remains a question some buyers weigh separately, and it is why the European Commission built a Cloud Sovereignty Framework with 48 criteria in eight categories to assess providers in its 2026 sovereign cloud tender. The Commission encourages other organisations to use it, but it is not a legal requirement for buying a reporting tool.

Also check what you send out yourself: alert channels, webhooks and AI integrations move report data to wherever those tools live.

What each service publishes

As stated on each vendor's public pages, read in early November 2026. Only what the pages say is listed. If a cell says "not stated", ask the vendor.

ServiceCompany and countryWhere reports are stored or processedProviders named for the serviceTransfer basis statedDefaults on personal data in reports
CentralCSPCentralSaaS SAS, FranceStored and backed up on OVHcloud, France; edge restricted to EU points of presenceOVHcloud (France), Bunny.net (EU), Scaleway (France)No transfer outside the EEA for customer data in the ordinary courseQuery strings, referrer and extension reports kept unless you turn on the filters
Report URIReport URI Ltd, UKRegion not stated; geographic hosting offered as an Enterprise add-onCloudflare, DigitalOcean, Microsoft Azure, among othersSCCs; providers other than Stripe Payments Europe and Xero "operate outside the UK or EEA"IP not stored; referrer, query string and fragments discarded by default
csideClient-Side Development, Inc., USRegion not stated; processing "from the United States and other countries"No full list on the privacy policyArticle 46 GDPR mechanisms, e.g. SCCsNot stated on the pages reviewed
SentrySentryUS (Iowa) or EU (Frankfurt) for event data; accounts, settings and audit logs always in the USNot reviewedNot reviewedNot stated on the pages reviewed
DatadogDatadogPer site; EU1 is in GermanyNot reviewedNot reviewedNot stated on the pages reviewed
URIportsURIports B.V., NetherlandsOwn servers colocated in the Netherlands"We do not use any subprocessors to process Personal Data"Processing in the EU per its DPAIP removed unless a server IP; query values stripped, keys kept
Self-hostedYouWhere you run itYour hosting providerYour choiceYour configuration

Sources per row: Report URI privacy policy (updated 8 October 2026) and pricing; cside privacy policy (effective 9 October 2026); Sentry data storage location; Datadog sites; URIports privacy policy and DPA.

A few notes on reading the table:

  • Sentry and Datadog give you a region choice. With Sentry, the region is fixed when the organisation is created and some account data stays in the US. With Datadog, each site is separate and you pick it when you sign up.
  • CentralCSP stores everything in France and keeps full URLs unless you turn on the filters. The ingestion filters (drop query strings and fragments, drop referrer, drop extension reports) are off when a site is created. Turn them on if your URLs can carry personal data.

A buyer's checklist

Send these to any reporting vendor. A good vendor answers each with a document, not a sentence.

  1. Where are reports stored at rest, and where are backups? Country, not "EU region".
  2. What sits in front of the endpoint? CDN or edge provider, and where its points of presence process the requests.
  3. Which sub-processors touch report data? A named list with country and purpose, and how you are told about changes (CentralCSP gives 30 days' notice with a right to object).
  4. Is there any transfer outside the EEA? If yes, under which mechanism: an adequacy decision such as the EU-US Data Privacy Framework, or Standard Contractual Clauses with a transfer impact assessment.
  5. Which company signs the contract, and where is it incorporated? Ask about the parent company too if jurisdiction matters to you.
  6. What is stored from each report? IP address, full URL with query string, referrer, user agent, script samples. Which of these can you switch off before storage?
  7. How long are reports kept, and can you delete them on demand?
  8. Where does support access come from? Who can read your reports, from which country.
  9. What certifications or audits exist, and whose are they? A data centre's ISO 27001 is not the vendor's.
  10. For DORA: will the vendor put the locations in the contract and notify you before changing them, as Article 30(2)(b) requires? Can it give you the fields your register needs?

How CentralCSP answers

  • Storage: all customer data is stored and backed up within the EU, on OVHcloud in France.
  • Edge: Bunny.net runs the CDN in front of the reporting endpoint, restricted to European points of presence. It processes IP addresses, browser information, requested URLs and reports in transit.
  • Sub-processors: OVHcloud (hosting, France), Bunny.net (edge, EU), Scaleway (transactional email, France). Stripe handles our billing as an independent controller and never receives report data.
  • Transfers: none outside the EEA for customer data in the ordinary course. Alert channels and AI tools you connect are destinations you choose and sit outside that commitment.
  • Retention: reports kept for a fixed 90 days, then deleted or irreversibly aggregated. Deleting a website deletes its reports.
  • What we hold and do not hold: an annual independent penetration test (report available on request). No ISO 27001 or SOC 2 certification of our own; OVHcloud's certifications cover its infrastructure.
  • Contract: French law, with the DPA available to sign on request.

If that matches what your DPO or procurement team needs, start the 14-day trial and connect a staging site first. To compare features rather than location, see CSP reporting services compared.

Sources