# CSP reporting and EU data residency: where each service keeps your reports (/en/blog/csp-reporting-eu-data-residency) Sooner or later someone asks where your CSP reports go. It might be your DPO filling in the record of processing, a procurement team working through a DORA register of information, or a security lead writing a NIS2 supplier policy. The answer is rarely "the vendor's website says EU". Reports pass through an edge network, land in a database, get copied to backups and sometimes reach an alert channel, and each step can sit in a different country. This post explains what to look at, compares what CSP reporting services published about it in early November 2026, and ends with a checklist you can send to any vendor, us included. CentralCSP stores reports in France. Every statement about another vendor links to the page it comes from. If you want to test CentralCSP first, [CentralCSP monitoring](/platform/monitoring) takes one header and the [Start plan has a 14-day free trial](/register). ## Why report location is a real question [#why-report-location-is-a-real-question] ### Reports contain personal data [#reports-contain-personal-data] A CSP violation report carries the URL of the page, the referrer, the blocked URL and, with the Reporting API, the browser's user agent ([W3C Reporting API](https://www.w3.org/TR/reporting-1/)). The browser removes fragments and credentials from URLs but keeps the query string ([CSP Level 3](https://www.w3.org/TR/CSP3/)). Add the IP address the report arrives from, and you have data that can relate to an identifiable person. The GDPR names IP addresses among the online identifiers that can identify people ([Recital 30](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)), and the Court of Justice held in *Breyer* (C-582/14, 19 October 2016) that a dynamic IP address can be personal data for a website operator ([judgment](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582)). The [personal data in CSP reports](/en/blog/csp-reports-personal-data-gdpr) post goes field by field. So a reporting service is a processor under GDPR, and where it processes data falls under the transfer rules of Chapter V ([Article 44](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)). ### DORA asks for the location in the contract and the register [#dora-asks-for-the-location-in-the-contract-and-the-register] For EU financial entities, [DORA Article 30(2)(b)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng) requires ICT contracts to state "the locations, namely the regions or countries, where the contracted or subcontracted functions and ICT services are to be provided and where data is to be processed, including the storage location", and the provider must give advance notice before changing them. [Article 28(3)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng) requires a register of information covering all ICT contracts. The register templates in [Implementing Regulation (EU) 2024/2956](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2956) include the country of the data at rest (field B_02.02.0150), required when a service supporting a critical or important function stores data, and the country where data is processed (B_02.02.0160), required whenever the service processes data. A CSP reporting tool on a banking site will usually not support a critical function. It still sits in the register, where the processing country is required anyway, and your procurement team will ask for it. ### NIS2 asks about suppliers, not residency [#nis2-asks-about-suppliers-not-residency] NIS2 does not require data to stay in the EU. [Article 21(2)(d)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) requires "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers", and Article 21(3) asks entities to consider each supplier's vulnerabilities and practices. For digital providers covered by [Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2690) (cloud, CDN, managed security, online marketplaces and others), the annex adds a supply chain policy with selection criteria (point 5.1) and a directory of suppliers (point 5.2). Where a supplier processes data is one of the facts that assessment uses. The [NIS2 and DORA third-party scripts](/en/blog/nis2-dora-third-party-scripts) post covers the wider picture. ## Residency, transfer and jurisdiction are three questions [#residency-transfer-and-jurisdiction-are-three-questions] Vendors often answer one and imply the other two. * **Residency:** where the data is stored at rest, backups included. * **Processing path:** where it travels before storage. Most report endpoints sit behind a CDN or edge network, which sees the IP address and the full payload. An EU database behind a global edge still processes data at the edge. * **Jurisdiction:** which country's law governs the provider and its sub-processors. Data stored in an EU region by a company headquartered elsewhere remains a question some buyers weigh separately, and it is why the European Commission built a [Cloud Sovereignty Framework](https://commission.europa.eu/news-and-media/news/sovereign-cloud-framework-explained-2026-06-01_en) with 48 criteria in eight categories to assess providers in its 2026 sovereign cloud tender. The Commission encourages other organisations to use it, but it is not a legal requirement for buying a reporting tool. Also check what you send out yourself: alert channels, webhooks and AI integrations move report data to wherever those tools live. ## What each service publishes [#what-each-service-publishes] As stated on each vendor's public pages, read in early November 2026. Only what the pages say is listed. If a cell says "not stated", ask the vendor. | Service | Company and country | Where reports are stored or processed | Providers named for the service | Transfer basis stated | Defaults on personal data in reports | | --------------- | --------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | | **CentralCSP** | CentralSaaS SAS, France | Stored and backed up on OVHcloud, France; edge restricted to EU points of presence | OVHcloud (France), Bunny.net (EU), Scaleway (France) | No transfer outside the EEA for customer data in the ordinary course | Query strings, referrer and extension reports kept unless you turn on the filters | | **Report URI** | Report URI Ltd, UK | Region not stated; geographic hosting offered as an Enterprise add-on | Cloudflare, DigitalOcean, Microsoft Azure, among others | SCCs; providers other than Stripe Payments Europe and Xero "operate outside the UK or EEA" | IP not stored; referrer, query string and fragments discarded by default | | **cside** | Client-Side Development, Inc., US | Region not stated; processing "from the United States and other countries" | No full list on the privacy policy | Article 46 GDPR mechanisms, e.g. SCCs | Not stated on the pages reviewed | | **Sentry** | Sentry | US (Iowa) or EU (Frankfurt) for event data; accounts, settings and audit logs always in the US | Not reviewed | Not reviewed | Not stated on the pages reviewed | | **Datadog** | Datadog | Per site; EU1 is in Germany | Not reviewed | Not reviewed | Not stated on the pages reviewed | | **URIports** | URIports B.V., Netherlands | Own servers colocated in the Netherlands | "We do not use any subprocessors to process Personal Data" | Processing in the EU per its DPA | IP removed unless a server IP; query values stripped, keys kept | | **Self-hosted** | You | Where you run it | Your hosting provider | Your choice | Your configuration | Sources per row: Report URI [privacy policy](https://report-uri.com/privacy-policy) (updated 8 October 2026) and [pricing](https://report-uri.com/pricing); cside [privacy policy](https://cside.com/privacy-policy) (effective 9 October 2026); Sentry [data storage location](https://docs.sentry.io/organization/data-storage-location/); Datadog [sites](https://docs.datadoghq.com/getting_started/site/); URIports [privacy policy](https://www.uriports.com/privacy) and [DPA](https://www.uriports.com/dpa). A few notes on reading the table: * **Sentry and Datadog give you a region choice.** With Sentry, the region is fixed when the organisation is created and some account data stays in the US. With Datadog, each site is separate and you pick it when you sign up. * **CentralCSP stores everything in France and keeps full URLs unless you turn on the filters.** The [ingestion filters](/en/docs/platform/websites/reporting-settings) (drop query strings and fragments, drop referrer, drop extension reports) are off when a site is created. Turn them on if your URLs can carry personal data. ## A buyer's checklist [#a-buyers-checklist] Send these to any reporting vendor. A good vendor answers each with a document, not a sentence. 1. **Where are reports stored at rest, and where are backups?** Country, not "EU region". 2. **What sits in front of the endpoint?** CDN or edge provider, and where its points of presence process the requests. 3. **Which sub-processors touch report data?** A named list with country and purpose, and how you are told about changes (CentralCSP gives 30 days' notice with a right to object). 4. **Is there any transfer outside the EEA?** If yes, under which mechanism: an adequacy decision such as the [EU-US Data Privacy Framework](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng), or Standard Contractual Clauses with a transfer impact assessment. 5. **Which company signs the contract, and where is it incorporated?** Ask about the parent company too if jurisdiction matters to you. 6. **What is stored from each report?** IP address, full URL with query string, referrer, user agent, script samples. Which of these can you switch off before storage? 7. **How long are reports kept, and can you delete them on demand?** 8. **Where does support access come from?** Who can read your reports, from which country. 9. **What certifications or audits exist, and whose are they?** A data centre's ISO 27001 is not the vendor's. 10. **For DORA:** will the vendor put the locations in the contract and notify you before changing them, as Article 30(2)(b) requires? Can it give you the fields your register needs? ## How CentralCSP answers [#how-centralcsp-answers] * **Storage:** all customer data is stored and backed up within the EU, on OVHcloud in France. * **Edge:** Bunny.net runs the CDN in front of the reporting endpoint, restricted to European points of presence. It processes IP addresses, browser information, requested URLs and reports in transit. * **Sub-processors:** OVHcloud (hosting, France), Bunny.net (edge, EU), Scaleway (transactional email, France). Stripe handles our billing as an independent controller and never receives report data. * **Transfers:** none outside the EEA for customer data in the ordinary course. Alert channels and AI tools you connect are destinations you choose and sit outside that commitment. * **Retention:** reports kept for a fixed 90 days, then deleted or irreversibly aggregated. Deleting a website deletes its reports. * **What we hold and do not hold:** an annual independent penetration test (report available on request). No ISO 27001 or SOC 2 certification of our own; OVHcloud's certifications cover its infrastructure. * **Contract:** French law, with the DPA available to sign on request. If that matches what your DPO or procurement team needs, [start the 14-day trial](/register) and connect a staging site first. To compare features rather than location, see [CSP reporting services compared](/en/blog/report-uri-alternatives). ## Sources [#sources] * [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng), Recital 30, Articles 28 and 44 to 46 * [CJEU, C-582/14 Breyer, 19 October 2016](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0582) * [Regulation (EU) 2022/2554 (DORA)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng), Articles 28 and 30 * [Implementing Regulation (EU) 2024/2956, register of information templates](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2956) * [Directive (EU) 2022/2555 (NIS2)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng), Article 21 * [Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2690), Annex, points 5.1 and 5.2 * [Commission Implementing Decision (EU) 2023/1795, EU-US Data Privacy Framework](https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng) * [European Commission, the Cloud Sovereignty Framework explained (1 June 2026)](https://commission.europa.eu/news-and-media/news/sovereign-cloud-framework-explained-2026-06-01_en) * [W3C, Reporting API](https://www.w3.org/TR/reporting-1/), [W3C, CSP Level 3](https://www.w3.org/TR/CSP3/) * Vendor pages listed under the table, read in early November 2026 ## Related [#related] * [CSP reporting services compared](/en/blog/report-uri-alternatives) * [Personal data in CSP reports and GDPR](/en/blog/csp-reports-personal-data-gdpr) * [NIS2, DORA and third-party scripts](/en/blog/nis2-dora-third-party-scripts) * [Data retention in CentralCSP](/en/docs/platform/security/data-retention)