Hosting an internal app with its data in the EU
You can keep an app, its database and its backups in an EU region if you set it up yourself on a cloud provider, if you use a host that offers one, or on Haechy, which stores an app, its database, its backups and uploaded code in the EU region (Ireland) when you choose it. Some supporting services, such as sending email, phone checks, payments and account records, can sit outside the region. The list below and our sub-processors page show which, so you can decide for your own case.
Updated 7 November 2026. This is information, not legal advice.
What "in the EU" can cover
An app is several pieces, and a provider can place each one differently.
| Piece | What to ask |
|---|---|
| The running app | Which region does the code run in? |
| The database | Which region holds the records? |
| Backups | Are they stored in the same region as the database? |
| Email the app sends | Which service sends it, and from where? |
| Sign-in and account records | Where do the provider's own accounts and sign-in logs live? |
| Support and staff access | Who at the provider can reach the data, and from where? |
A host that says "EU region" might mean the first two, or all six. Ask about each.
The options
One of the big clouds. If you run things on a large cloud provider directly, you choose the region, and then you also set up the database, the backups, the sign-in and the network yourself. That is a cloud engineer's job.
A database service with a region setting. Supabase, for one, lets you pick a region for a project. Its own documentation says "Region selection is a data-location control, not proof of regulatory compliance." That applies broadly. You would still need a host for the app and a way to check where it runs.
A host with an EU region. Whatever the host, you still need to ask the questions in the table, including who its sub-processors are and where its support staff work. InstaPods, for one, lists France as a region. Hatchable's privacy policy says it is hosted primarily in the United States, and AppDeploy's security page names us-east-1 (Northern Virginia) as its region, both checked 7 November 2026.
Haechy. You tell Claude which region you want ("put it in the EU region"), and the app, its database, its nightly backups and its uploaded code are stored there. It needs no cloud engineer. On the Free plan, one region applies to the whole workspace; on paid plans you choose per app. The first app in a new region can take a few minutes longer to start.
What doesn't stay in the region on Haechy:
- Your Haechy account, sign-in records, approvals, members and app settings run on Haechy's control plane in the US.
- Email an app or sign-in sends goes through Amazon Web Services in the US (Northern Virginia) for every region. That email can include addresses and the content of messages the app sends.
- Phone checks run through Twilio, United States by default, and payments through a payment provider. Paid checkout isn't open yet.
- App secrets are kept encrypted on the US control plane and sent to the app's region when it starts.
- Code passes through the US control plane on its way to the region, and is deleted from there after 2 days.
- What you show Claude goes to Anthropic, under your own Claude account and its terms.
Some services we use to send email, verify phone numbers and take payments process data outside your chosen region. See our sub-processors. Haechy adds a plain caveat of its own: a region choice doesn't put data out of reach of the law of other countries, because the servers in every region are run by a US cloud provider. The regions page has the full table.
Five questions for any host
- Where are the backups kept, and for how long?
- Who are your sub-processors, and will you tell me before you add one? (Haechy's list is public, dated, and its owners are emailed before a new one starts handling their app data, so they can object.)
- What do your terms say about processing my data? Haechy has no separate DPA document. Its processor terms are clause 7 of the terms of service: it acts as processor for app data on your instructions, with a sub-processor list, help with data-subject requests, breach notice without undue delay and deletion or return at the end.
- How do I get my data deleted? On Haechy, ask at privacy@haechy.com; it completes deletion within 30 days. There is no one-click export yet, but Claude can read out the data from the app's database.
- Who can reach my data on your side? Haechy says its staff can technically reach customer data on its servers, and that it takes vulnerability reports but makes no claim that it can't be breached.
If you are in the UK or Australia
Haechy has regions in London (UK) and Sydney (Australia) as well. The same list applies: the app, database and backups sit in the region you choose, and the account side and email go through the US. The terms cover UK GDPR and EU GDPR as well as Swiss law.
Where to go next
For the cost of the setup, see hosting a small internal tool with a database and logins. Your IT team will find controls in the security page, the trust page and the IT page; plans are on pricing.