Trust Center
Data residency & hosting in Germany
The goal: data and media stay in the EU region you choose. Hosting in Germany is planned. What lives where, and who can reach it, is set out in documents you receive on request.
At a glance
- Designed for
The platform is built toward the requirement. Evidence such as an attestation does not exist yet – we name it as soon as it does.
- On request
The documents exist. You receive them for your review through the contact form.
- Available
Met and evidenced. We assign this level only once the evidence exists.
- List of sub-processorsOn request
- Retention and deletion policyOn request
- Description of data export and portabilityOn request
#What data residency means
Data residency means you know in which region your data is stored and processed. And the commitment covers everything a customer contact produces, not just the records in your CRM.
A contact centre generates recordings, transcripts, chat histories, email attachments, screen recordings and analytics. Each of these raises the same two questions: where does it live, and who can get to it?
#Regions and hosting in Germany
Univerx runs on a multi-tenant cloud with several regions, described under Regions & availability. European customers are served from EU regions; you pick the region during setup.
Hosting in Germany is planned. We say “planned” on purpose: we call a region available only when it is available for your contract. The current position is confirmed in writing in our proposal.
#Which data lives where
Residency is only as strong as its weakest data type. That is why Univerx states the goal for each group separately.
| Data type | Examples | Goal |
|---|---|---|
| Contacts and cases | Customer data, history, notes | chosen EU region |
| Media | Recordings, screen recordings, attachments | chosen EU region |
| Derived data | Transcripts, summaries, analytics | chosen EU region |
| Operational data | Logs, metrics | described in the documents |
The table describes the design goal. Where a single service differs, the list of sub-processors names its location and safeguard.
#Sub-processors and access
Residency does not stop at the storage location. Access from a third country, for support for example, is a transfer under the GDPR and needs a basis under Chapter V.
So Univerx lists every service involved with its purpose and location. You receive the list on request. How changes are announced is governed by the data processing agreement, described on the GDPR page.
#Export and deletion
Data you cannot take with you ties you to a vendor. Univerx provides for export, and for ongoing analytics a structured feed into your own data warehouse through BI data export.
Deletion follows the periods you set per data type. When the contract ends, you export your data; Univerx then deletes it according to the agreed retention and deletion policy.
Questions for your review
The article Data residency: the five questions procurement and privacy ask goes deeper into these questions. The glossary explains the term under data residency.
#Sources
- Regulation (EU) 2016/679 (GDPR), Chapter V (Art. 44–50) on transfers to third countries, on EUR-Lex.
Products
Where the topic applies.
The product families this topic matters most for.
Univerx Cloud
One cloud for every customer contact.
- EU
- BSI C5
- NIS2
Univerx Contact Center
Every contact in the right queue.
- DSGVO
- BFSG
- EU
Univerx AI
AI that resolves requests and backs up people.
- AI Act
- DSGVO
- EU
Univerx Trust Center
Security and regulation as a design principle, not an appendix.
- DSGVO
- EU
- AI Act
- BSI C5
- eIDAS
- NIS2
- DORA
- BFSG
Trust & Europe
Every topic in the trust center.
Every topic carries a status. It tells you what is a design goal, which documents you can request and what is evidenced today.
| Topic | Status |
|---|---|
| GDPR | On request |
| Data residency & hosting in Germany | Designed for · German hosting planned |
| EU AI Act | Designed for |
| BSI C5 | Designed for · goal, no attestation |
| eIDAS & online ID | Designed for |
| NIS2 | Designed for |
| DORA | Designed for |
| European Accessibility Act | Designed for · WCAG 2.1 AA as a goal |
| Responsible AI | Designed for · principles & controls |
| Security & availability | Designed for |
| United States: HIPAA, PCI DSS, SOC 2, TCPA, CCPA | Designed for |
Frequently asked questions
Is hosting in Germany available today?
Hosting in Germany is planned. The regions available for your contract are confirmed in writing in our proposal. We only call a region available once it is.
Does the region also apply to recordings and attachments?
That is the goal: data and media, meaning recordings, transcripts, files and attachments, stay in the chosen region. If a single service differs, the list of sub-processors says so.
What about access from outside the EU?
Access, for example for support, is processing too. Whether it happens, and under which safeguards in Chapter V GDPR, is set out in the list of sub-processors and the data processing agreement.
What happens to the data when the contract ends?
You export the data in an agreed format. Afterwards it is deleted according to the agreed retention and deletion policy.
Related
Trust & EuropeGDPR
Processing under Art. 28 GDPR, documents for your data protection impact assessment, retention and deletion policies and role rights. What exists you receive on request; what is a goal we call a goal.
Trust & EuropeSecurity & availability
Encryption in transit and at rest, identity and access management, network and API security, multi-zone availability and continuity plans: what Univerx is designed for so your customer service keeps running.
Trust & EuropeBSI C5
The C5 criteria catalogue of Germany's Federal Office for Information Security sets minimum requirements for secure cloud services. Univerx is designed for it. We name an attestation only once it exists – with type, period and version.
Trust & EuropeNIS2
NIS2 obliges companies in essential sectors to manage risk, report incidents and secure their supply chain. Univerx is a link in that chain and is designed to support your duties with documents and clear reporting lines.
Guides2 November 2026 · 11 min readRunning a contact centre in Europe
What the GDPR, the EU AI Act and German co-determination mean for routing, recording and analytics – and how to answer the questions from procurement, privacy and the works council before the first contact runs on a new platform.
Guides2 November 2026 · 11 min readCloud migration from your existing system
Connect telephony, move channels, train teams: how a contact centre moves step by step from its existing system to the cloud – with inventory, sequencing, a cutover plan, risks and a checklist.
Europe & regulation1 November 2026 · 5 min readData residency: the five questions procurement and privacy ask
"The data stays in Europe" is a good start, but not an answer. Five questions procurement and privacy teams follow up with, and what makes an answer reliable.
GlossaryData residency
Data residency describes where data and media are stored and processed. In customer service that covers not just the database but recordings, transcripts, AI processing, backups and support access.
GlossaryData processing agreement (DPA)
Using a cloud platform for customer service means a provider processes personal data for you. A data processing agreement under Art. 28 GDPR sets out the roles, instructions and duties involved.
GlossaryData protection impact assessment (DPIA)
A data protection impact assessment examines in advance what risks a processing operation poses to the people concerned and how to limit them. In customer service it often applies to analytics, recording and AI.
See Univerx on your own example.
In a demo we show the platform along your channels and requests, from AI agents to video, workforce scheduling and analytics.
Online, in German or English, with no preparation on your side.