For regulated teams/Data residency
Data residency · GDPR Ch. V · Schrems II

Data can’t cross a border it never leaves.

Keep financial and personal data in your own region by never sending it to a vendor. Blueprint renders inside your infrastructure — so there’s no cross-border transfer to find a legal basis for, and no third-party access to justify.

Self-hostedIn your regionNo egress

The honest version: these frameworks restrict cross-border transfers and third-party access — they don’t mandate residency. Self-hosting removes the trigger.

The requirement

What the rules actually say.

No major framework mandates “data residency.” They restrict transfers and demand control over where data sits and who can reach it.

Transfers
Cross-border transfers are restricted — not free
  • Under GDPR Chapter V (Arts. 44–50), moving EU personal data to a third country needs an adequacy decision, SCCs/BCRs, or a narrow derogation.
  • After Schrems II (CJEU C-311/18, 2020), SCC transfers to the US also need a case-by-case assessment and supplementary measures — Privacy Shield was invalidated, SCCs were upheld.
Source: CJEU C-311/18 (EUR-Lex) ↗
Control
Regulated-sector rules demand known location and access
  • The EBA outsourcing guidelines (EBA/GL/2019/02) require institutions to know and risk-assess where data is stored and processed, and to keep full access and audit rights — not to store it EU-only.
  • MAS and the 2023 US interagency guidance require managing the added legal-jurisdiction risk of foreign-based providers — not domestic storage.
Source: EBA — Guidelines on outsourcing ↗
The problem

Why a hosted UI layer makes it harder.

1

A UI layer that phones home to a vendor cloud is a cross-border transfer and third-party access you have to document and defend — even for what’s “just” on screen.

2

Proxied data (served through the vendor) puts someone else’s jurisdiction in your hot path on every request. (The dynamic documented on Plasmic — 1–3s proxied latency.)

3

“Residency” is a patchwork — no single law says “keep it in-country” — but the transfer rules and the access-rights rules all get simpler when the data never leaves.

The answer

How Blueprint removes the trigger, point by point.

Rule
What it needs
How self-hosting answers it
GDPR Ch. V · transfers
A legal basis for any third-country transfer.
Self-hosted in your region, the data never leaves your infrastructure — so there’s no Chapter V transfer to find a basis for.
Schrems II · third-country access
Assess US-surveillance exposure for SCC transfers.
No vendor receives the data, so there’s no SCC assessment or supplementary measure to build for this path.
EBA / MAS · known location + access
Location known, risk-assessed; access & audit rights kept.
The location is your own VPC, in your region; your team keeps full access, and the runtime is open source to inspect.
OCC 2023-17 · third-party risk
Manage foreign-jurisdiction risk of providers.
There’s no foreign-based third party in the path to manage — the runtime is code you run yourself.
The evidence

What an auditor sees: your data, where you left it.

A change to the screen is a reviewable diff — and the runtime that serves it makes no call to us.

contracts/account.json · PR #611 · region-pinned
{ "type": "form", "id": "account",
  "region": "eu-central-1",
  "fields": [
    { "type": "text", "label": "IBAN" }
    { "type": "text", "label": "IBAN", "mask": true }
  ] }

Data that left your region

0bytes egressed to a vendor

Network at runtime

  • Egress to vendor 0
  • Region eu-central-1
  • Proxy in hot path 0

The honest part

Blueprint doesn’t make you GDPR / EBA / MAS compliant, and none of these frameworks mandate data residency. By never egressing data, it removes the cross-border transfer and the third-party access those frameworks make you assess and justify. The rest of your compliance stays yours.

For your security review

The questions your compliance team will ask.

Does GDPR require data to stay in the EU?

No. GDPR restricts cross-border transfers (Chapter V) — via adequacy, SCCs/BCRs, or a narrow derogation — it doesn’t mandate residency. Self-hosting in-region simply means there’s no transfer to find a basis for.

Do EBA / MAS / OCC require in-country data?

No. They require you to know and risk-assess the location and preserve access and audit rights (EBA), keep supervisors’ access (MAS), and manage the added legal-jurisdiction risk of foreign providers (OCC). Self-hosting satisfies those cleanly — but it’s a benefit, not a mandate we attribute to them.

What did Schrems II actually change?

It invalidated the EU-US Privacy Shield and made SCC-based transfers to the US conditional on a case-by-case assessment plus supplementary measures — it did not ban SCCs. If the data never reaches a US vendor, there’s no such transfer to assess for that flow.

Does self-hosting make us compliant?

No — it removes a specific vector (cross-border transfer / vendor access). The rest of your compliance stays yours.

Sources

Verify it yourself.

Every claim on this page traces to a primary or authoritative source.

Bring us your hardest audit

The data never leaves. The transfer never happens. Nothing to assess.