Only five of 22 live chat tools keep your data in the EU by default
We read the sub-processor lists, data processing agreements and hosting policies of 22 live chat vendors. Where the conversations are stored, what "EU hosting" really covers, and which AI companies read the messages.
The muro team
muro.chat
- Published
- Reading time
- 11 min
On this page
- Where the data is stored
- "EU hosting available" comes with conditions
- EU hosting does not mean nothing leaves the EU
- Which AI companies read the messages
- Why we do not rank vendors by number of US sub-processors
- Some documents are old
- Six questions to ask before you install a chat widget
- Method and limits
- Sources
Ask a live chat vendor where your customers' messages are stored and the sales page will usually say "GDPR compliant". The legal pages say more. We read the sub-processor lists, data processing agreements, hosting policies and privacy policies of 22 live chat tools, and recorded for each one what the vendor itself writes, with the quote and the link. No comparison sites, no vendor blog posts unless nothing else exists, nothing from memory.
5 of 22
store customer data in the EU by default
7
offer EU hosting as an option, each with its own conditions
14
name OpenAI as a sub-processor
6
do not publish their data processing agreement
Where the data is stored
EU data residency across 22 live chat vendors
What each vendor's own legal and help pages say about storing customer data in the EU. Hover or focus a bar for the names.
View as table
| EU data residency across 22 live chat vendors | Note | |
|---|---|---|
| EU by default | 5 | Crisp, Tidio, Smartsupp, Lime Connect (Userlike), Brevo |
| EU as an option | 7 | Intercom, Zendesk, LiveChat, HubSpot, Freshchat (Freshworks), Zoho SalesIQ, Front |
| No EU option | 5 | tawk.to, Drift (Salesloft), Olark, Help Scout, Chatwoot (cloud) |
| Unclear | 5 | Gorgias, HelpCrunch, JivoChat, Chatra, Re:amaze |
Source: Vendor legal pages, sub-processor lists and help centres, read on 10 October 2026. Compiled by muro.
The five that store data in the EU by default are Crisp, Tidio, Smartsupp, Lime Connect (Userlike) and Brevo. Four of them are European companies; Tidio stores data in the European Economic Area but its contracting entity is a US company. At the other end, tawk.to, Drift (Salesloft), Olark, Help Scout and Chatwoot (cloud) describe no EU option at all.
For Gorgias, HelpCrunch, JivoChat, Chatra and Re:amaze, we could not tell. Their pages either do not say where customer data is hosted, contradict each other, or rely on documents written years ago. "Unclear" is not a verdict on their infrastructure: it means a buyer reading the public documents cannot find the answer either.
"Company based in" is the contracting or registered entity named on the legal pages, not necessarily where the team works. Only four of the 22 vendors are EU companies: Crisp, Smartsupp, Lime Connect (Userlike) and Brevo.
"EU hosting available" comes with conditions
The seven vendors that offer EU hosting as an option do not mean the same thing by it. For some it depends on the plan, for some on when you signed up, and for some on asking.
Where a vendor assigns the region at sign-up, an existing account usually cannot be moved without a new workspace or a paid plan. Read the linked page before you sign up, not after.
EU hosting does not mean nothing leaves the EU
For nine of the 12 vendors that store data in the EU by default or as an option, their own pages describe data that still goes outside it: a sub-processor in the US, an email relay, a content delivery network, or analytics.
This is not a list of breaches. Transfers outside the EU are legal with a recognised mechanism, such as the EU-US Data Privacy Framework or standard contractual clauses, and most vendors here name one in their DPA. Two do not in what we could read: Lime Connect only sends its DPA on request, and Smartsupp's list gives "Concluded DPA" as the transfer measure. The point is that "hosted in the EU" answers where the database is, not which companies can read the data.
Which AI companies read the messages
Every AI feature in a chat tool sends message content to a model. The sub-processor lists say whose. OpenAI comes up most, named by 14 of the 22 vendors; Anthropic by 5. Two vendors, Crisp and Brevo, mark their third-party AI providers as optional or off by default.
AI providers named in live chat sub-processor lists
Number of vendors, out of 22, whose sub-processor list names each AI provider. Some lists cover the vendor's whole platform, not only chat.
View as table
| AI providers named in live chat sub-processor lists | Note | |
|---|---|---|
| OpenAI | 14 | Marked optional or off by default at 2 of them. |
| 7 | Marked optional or off by default at 2 of them. | |
| Anthropic | 5 | Marked optional or off by default at 2 of them. |
| Microsoft | 5 | Marked optional or off by default at 1 of them. |
| Mistral | 2 | Marked optional or off by default at 1 of them. |
| Amazon | 2 |
Source: Vendor sub-processor lists, read on 10 October 2026. Compiled by muro.
For Tidio, Drift (Salesloft), HelpCrunch and Lime Connect (Userlike) the list could not be read: it is a gated document, a PDF behind a portal or only sent on request. "None listed" means the list we read names no AI provider for this product.
A sub-processor list says who may receive data, not whether your account sends it. Crisp, Brevo and Chatwoot say explicitly that messages only reach a third-party model once the customer turns the feature on, and Zoho notes that customers can connect their own AI keys. The list is still the only public record of where the messages can go once AI is on.
Why we do not rank vendors by number of US sub-processors
It is tempting to count the sub-processors located in the US and rank the vendors. The lists do not allow it. Some give the country where the sub-processor company is incorporated, some the country where data is hosted, some the country where processing happens for each data center, and some a single "location" they do not define. Crisp is the clearest example: nine of its thirteen sub-processors are US companies, but only one row says customer data is held in the US.
Scope differs too. Zendesk, HubSpot and Brevo publish one list for their whole platform, chat being one product among many, and Chatwoot's includes its internal HR tools. The downloadable dataset records, for each vendor, exactly what was counted and on what basis.
Some documents are old
An old document is not necessarily wrong, but it cannot be relied on to describe today's sub-processors. Ask for the current list.
Six questions to ask before you install a chat widget
- Where is my account hosted, and is that the default or something I must choose? If it is chosen at sign-up, choose before you create the workspace.
- Can you send me the sub-processor list that applies to my region and plan? Several vendors publish one list per region; the EU list is often shorter.
- Which sub-processors still process data outside the EU with EU hosting? Email, content delivery and analytics are the usual ones.
- Which AI providers receive message content, and is it off by default? Ask whether you can turn AI off per site and whether you can use your own model key.
- Is the DPA public, and can I sign it without negotiating? Six of the vendors here only send it on request.
- When was the list last updated, and how will I be told about changes? Look for a date on the page and a notice period for new sub-processors.
Method and limits
- Sources. Only the vendors' own pages: sub-processor lists, data processing agreements, terms, privacy policies, trust centres, security pages and official help centres, read on 10 October 2026. Web search was used only to find the official URLs.
- Quotes. Every finding rests on a verbatim quote of 200 characters or less. All 221 quotes were checked by script against the saved text of the page they come from. Four pages that only render with JavaScript were read through a headless browser.
- Coverage. Every field is sourced for 13 vendors; for 9 one or more fields could not be established, usually because a list is gated or only sent on request. Those fields are marked, never guessed.
- Product scope. Where a vendor publishes one list for several products, we kept only the rows that name the chat product when the list allows it (Freshworks, Zoho), and otherwise the whole list.
- Renamed vendors. Userlike is now Lime Connect, Drift belongs to Salesloft, LiveChat is a product of Text, Inc., and Chatra says it is "now a Brevo company" while its legal pages still name its former owner. We used the documents that apply to each product.
- What this is not. A reading of public documents, not an audit. Contracts negotiated by large customers can differ from the public terms.
For transparency about our own product: muro runs its servers and database at Hetzner in Nuremberg, Germany, and sends email through Amazon SES in Ireland. It also has US sub-processors: Cloudflare, which carries all traffic and stores our encrypted backups, and Anthropic, which receives message content only when AI is on for a site. Stripe handles billing. The list, with the safeguard for each transfer, is on our sub-processors page, and the DPA is public.
Related research: what AI support agents cost per resolution, what the EU AI Act requires of chatbots, and what 25 chat widgets do before you click anything.
Sources
- 1Intercom: hosting and data location (accessed 2026-10-10)
- 2Intercom: sub-processor list (accessed 2026-10-10)
- 3Zendesk: hosting and data location (accessed 2026-10-10)
- 4Zendesk: sub-processor list (accessed 2026-10-10)
- 5Crisp: hosting and data location (accessed 2026-10-10)
- 6Crisp: sub-processor list (accessed 2026-10-10)
- 7Tidio: hosting and data location (accessed 2026-10-10)
- 8Tidio: sub-processor list (accessed 2026-10-10)
- 9LiveChat: hosting and data location (accessed 2026-10-10)
- 10LiveChat: sub-processor list (accessed 2026-10-10)
- 11tawk.to: hosting and data location (accessed 2026-10-10)
- 12tawk.to: sub-processor list (accessed 2026-10-10)
- 13HubSpot: hosting and data location (accessed 2026-10-10)
- 14HubSpot: sub-processor list (accessed 2026-10-10)
- 15Freshchat (Freshworks): hosting and data location (accessed 2026-10-10)
- 16Drift (Salesloft): hosting and data location (accessed 2026-10-10)
- 17Drift (Salesloft): sub-processor list (accessed 2026-10-10)
- 18Olark: hosting and data location (accessed 2026-10-10)
- 19Olark: sub-processor list (accessed 2026-10-10)
- 20Help Scout: hosting and data location (accessed 2026-10-10)
- 21Help Scout: sub-processor list (accessed 2026-10-10)
- 22Gorgias: hosting and data location (accessed 2026-10-10)
- 23Zoho SalesIQ: hosting and data location (accessed 2026-10-10)
- 24Zoho SalesIQ: sub-processor list (accessed 2026-10-10)
- 25Smartsupp: hosting and data location (accessed 2026-10-10)
- 26Smartsupp: sub-processor list (accessed 2026-10-10)
- 27HelpCrunch: hosting and data location (accessed 2026-10-10)
- 28JivoChat: hosting and data location (accessed 2026-10-10)
- 29JivoChat: sub-processor list (accessed 2026-10-10)
- 30Chatwoot (cloud): hosting and data location (accessed 2026-10-10)
- 31Chatwoot (cloud): sub-processor list (accessed 2026-10-10)
- 32Lime Connect (Userlike): hosting and data location (accessed 2026-10-10)
- 33Brevo: hosting and data location (accessed 2026-10-10)
- 34Chatra: hosting and data location (accessed 2026-10-10)
- 35Chatra: sub-processor list (accessed 2026-10-10)
- 36Front: hosting and data location (accessed 2026-10-10)
- 37Front: sub-processor list (accessed 2026-10-10)
- 38Re:amaze: hosting and data location (accessed 2026-10-10)
