Data can’t cross a border it never leaves.
Keep financial and personal data in your own region by never sending it to a vendor. Blueprint renders inside your infrastructure — so there’s no cross-border transfer to find a legal basis for, and no third-party access to justify.
The honest version: these frameworks restrict cross-border transfers and third-party access — they don’t mandate residency. Self-hosting removes the trigger.
What the rules actually say.
No major framework mandates “data residency.” They restrict transfers and demand control over where data sits and who can reach it.
- Under GDPR Chapter V (Arts. 44–50), moving EU personal data to a third country needs an adequacy decision, SCCs/BCRs, or a narrow derogation.
- After Schrems II (CJEU C-311/18, 2020), SCC transfers to the US also need a case-by-case assessment and supplementary measures — Privacy Shield was invalidated, SCCs were upheld.
- The EBA outsourcing guidelines (EBA/GL/2019/02) require institutions to know and risk-assess where data is stored and processed, and to keep full access and audit rights — not to store it EU-only.
- MAS and the 2023 US interagency guidance require managing the added legal-jurisdiction risk of foreign-based providers — not domestic storage.
Why a hosted UI layer makes it harder.
A UI layer that phones home to a vendor cloud is a cross-border transfer and third-party access you have to document and defend — even for what’s “just” on screen.
Proxied data (served through the vendor) puts someone else’s jurisdiction in your hot path on every request. (The dynamic documented on Plasmic — 1–3s proxied latency.)
“Residency” is a patchwork — no single law says “keep it in-country” — but the transfer rules and the access-rights rules all get simpler when the data never leaves.
How Blueprint removes the trigger, point by point.
What an auditor sees: your data, where you left it.
A change to the screen is a reviewable diff — and the runtime that serves it makes no call to us.
{ "type": "form", "id": "account", "region": "eu-central-1", "fields": [ { "type": "text", "label": "IBAN" } { "type": "text", "label": "IBAN", "mask": true } ] }
Data that left your region
Network at runtime
- Egress to vendor 0
- Region eu-central-1
- Proxy in hot path 0
The honest part
Blueprint doesn’t make you GDPR / EBA / MAS compliant, and none of these frameworks mandate data residency. By never egressing data, it removes the cross-border transfer and the third-party access those frameworks make you assess and justify. The rest of your compliance stays yours.
The questions your compliance team will ask.
Does GDPR require data to stay in the EU?
No. GDPR restricts cross-border transfers (Chapter V) — via adequacy, SCCs/BCRs, or a narrow derogation — it doesn’t mandate residency. Self-hosting in-region simply means there’s no transfer to find a basis for.
Do EBA / MAS / OCC require in-country data?
No. They require you to know and risk-assess the location and preserve access and audit rights (EBA), keep supervisors’ access (MAS), and manage the added legal-jurisdiction risk of foreign providers (OCC). Self-hosting satisfies those cleanly — but it’s a benefit, not a mandate we attribute to them.
What did Schrems II actually change?
It invalidated the EU-US Privacy Shield and made SCC-based transfers to the US conditional on a case-by-case assessment plus supplementary measures — it did not ban SCCs. If the data never reaches a US vendor, there’s no such transfer to assess for that flow.
Does self-hosting make us compliant?
No — it removes a specific vector (cross-border transfer / vendor access). The rest of your compliance stays yours.
Verify it yourself.
Every claim on this page traces to a primary or authoritative source.
- Schrems IIEUR-Lex — CJEU Case C-311/18 — invalidated Privacy Shield; upheld SCCs, conditioned on assessment + supplementary measures.
- GDPR transfersEUR-Lex — GDPR Chapter V (Arts. 44–50) — transfers need adequacy, SCCs/BCRs, or a derogation; residency isn’t mandated.
- OutsourcingEBA — Guidelines on outsourcing (EBA/GL/2019/02) — know & risk-assess location; preserve access/audit rights. (Re-read exact paragraph numbers before printing them.)
- US interagencyOCC Bulletin 2023-17 — Third-party risk management — manage foreign-jurisdiction risk; no residency mandate.