Data Residency for Automation Tools: What Vendors Publish

Your automation data sits wherever your vendor's cloud provider put it, it lingers in logs and backups longer than the vendor's headline retention number, and none of that shields it from a US legal demand if the vendor is a US company. Those are three separate questions, and buyers who ask "is it secure?" get an answer to none of them.

We read the published documentation for Zapier, Make, n8n and Microsoft Power Automate on 10 September 2026. The Bot Desk has no lab and tests nothing: everything below is what a vendor's own page says, with the date we read it. Where a vendor publishes no answer, we say so, because that is itself a finding.

Three questions, not one

The first is processing: while a workflow runs, which machine in which country holds the record and makes the outbound calls? The second is storage: afterwards, what stays behind — run history, step logs, variables, the error payload carrying a customer's full address — in which country, and for how long?

The third is the one that binds you: who can be compelled to hand it over? That does not follow the server. It follows the vendor's corporate domicile and the law's reach over the entity controlling the data. A US-domiciled company holding your records in Frankfurt is still a US company holding your records.

Zapier: the United States, and it says so plainly

Zapier publishes a flat no. Its Data Privacy Overview, read 10 September 2026, poses the question under the heading "Is there an option to have my data stored only within the EU?" The answer is five words: "Zapier does not support this option." The same page states: "Zapier hosts data in AWS servers located in the United States, including customers' personal data and the data that is processed on behalf of customers." There is no regional picker to configure.

Storage is where Zapier's documentation earns its keep. Its Data Retention/Deletion/Export page, last updated 17 April 2026, splits one payload into separate lifespans. Zap Content and Zap Runs live "29-69 days in your Zapier account", and "If you subscribe to the Company or Enterprise plan, you can set a shorter retention period." Separately they live "7 days in logs." And separately again: "Up to 4 months in backups."

Two lines deserve rereading. "Zap Content transferred when you test a Zap is stored until you delete the Zap" — the test record you pushed through with real customer data has no expiry until you act. And: "Zap Runs are also stored in Zapier's non-production database for internal Zapier product analytics purposes." A help article last updated 29 May 2026 adds that "Zap history retention can be customized to 7-30 days long" where that setting exists.

Make: you can choose the country, and it is in the sub-processor list

Make runs distinct zones. Its developer documentation on API structure, read 10 September 2026, lists the zone base URLs as eu1.make.com, eu2.make.com, us1.make.com and us2.make.com, plus two on make.celonis.com. It describes a zone URL as referring to "the geological location of the region and environment of your Make organization" — Make's word, not ours; it plainly means geographical.

So the zones show up in your URL bar. What Make's help and marketing pages never say is which country each zone is. The security page says "Our infrastructure resides within Amazon AWS EC2 private instances (Amazon VPC) with Amazon Enterprise support in place" — naming no country. Its privacy and GDPR page names no data centre location either.

The answer is in the sub-processor list, a PDF linked from the terms, effective 12 December 2025. The Amazon Web Services entry reads "Hosting location can be selected by customer: ● United States," then "● Germany (enterprise), Ireland (others)". The MongoDB entry, the database "for scenarios creation", splits the same way: "Hosting location for EU customers: Germany (enterprise)," and "Ireland (others)", against "Hosting location for non-EU customers: United States".

Read plainly: a US customer's scenario database sits in the United States, a European customer's in Ireland, and Make documents that in an annexe rather than its help centre. On retention the security page says "By default, log data is stored for 30 days."

n8n: the EU in cloud, your own rack if you want it

n8n is the only one of the four publishing an EU default for its hosted product. Its security page, read 10 September 2026, states: "n8n cloud uses Microsoft Azure for hosting." It continues: "The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union." On backups, the process "backs up or replicates data to a separate region in the same country." Its sub-processor list agrees: Microsoft Azure at "EU (Germany, Sweden)", Hetzner Online at "Germany". The AI providers do not — OpenAI, Anthropic, LangChain and Daytona are listed as US, Google Vertex AI as "EU, US". The engine is in the EU; the optional AI steps are not, which is the whole ballgame if your workflow pipes customer text into a model.

What n8n does not document is a US cloud region; we found no page offering one. If your requirement is "this must not leave the United States", n8n Cloud as documented is the wrong shape and self-hosting is the answer. Its docs are direct: for cloud, "n8n is considered both a Controller and a Processor as defined by the GDPR", while for self-hosted deployments "n8n is neither a Controller nor a Processor, as we don't manage your data". Self-hosting moves residency into your hands along with the work — the same docs note that "Self-hosters must ensure data is encrypted in transit". Its cloud data page defines the leftovers, since "Execution data includes node data, parameters, variables, execution context, and binary data references", and tiers retention by plan up to "unlimited execution log retention time" on Enterprise.

Power Automate: a region you pick, a boundary with documented exits

Microsoft publishes more here than the other three combined. Its guidance on choosing an environment region, last updated 29 May 2026, states: "Environments can be created in different regions, and are bound to that geographic location." The binding covers "databases in the Microsoft Dataverse, apps, connections, gateways, and custom connectors", and its datacenter regions page, last updated 12 June 2026, lists more than twenty.

Run history is documented twice, with two numbers. The limits page, last updated 18 July 2026, gives "Run retention in storage: 30 days." The Dataverse run-history page, last updated 19 May 2026, says "By default, flow run data is stored for 28 days".

Why "EU data centre" is not "EU only"

A region setting governs where the primary copy lives. It does not govern support access, sub-processors, telemetry, or the routes packets take. Microsoft is the most candid here, because it publishes the exceptions. Its EU Data Boundary overview, last updated 26 February 2025, describes a "geographically defined boundary" for customer data, then concedes "limited circumstances where Customer Data, personal data, and Professional Services Data will continue to be transferred outside the EU Data Boundary." A companion page on continuing transfers, last updated 30 March 2026, enumerates them: "authorized Microsoft personnel may require remote access to data stored within the EU Data Boundary", and routing, since "Microsoft uses variable network paths that may occasionally result in routing of customer traffic outside of the EU Data Boundary."

AI features are their own category. Microsoft's page on moving data across regions for generative AI, last updated 22 May 2026, says "you might need to allow data movement across regions to use Copilots and generative AI features" and that "your inputs (prompts) and outputs (results) might move outside of your region." Its table shows that for a Europe environment the model runs inside the EU Data Boundary while Bing Search data goes to the United States. Microsoft also states that "Microsoft doesn't log, store, or retain any input or output data during this process" — a vendor commitment on a published page, which we report as such.

Make's list makes the same point without a boundary document. Support comes from Celonis affiliates, with the note that "Customer Support is mainly provided by personnel of the" "entity in the Czech Republic", and the list includes Fiverr International Ltd. of Tel Aviv, hosted in the United States, for support from independent freelancers. Analytics sits in the Netherlands, ticketing in Germany, AI providers in the United States and France. The Make DPA, last modified 3 May 2024, says "Processor's personnel may access Controller's instance on a case-by-case basis if requested by the Controller".

Zapier lists every third-party sub-processor's location as USA, but not its affiliates: Australia with a branch in New Zealand, Canada, Ireland with a branch in Spain, India, and the UK. That page was effective 19 September 2026 when this was written; re-read on October 17, 2026 it carries a posted date of October 9 and an effective date of October 23, 2026, with the September version kept behind a "Prior Version" link. The affiliate list above is the one that page carries on that re-reading. Its DPA, effective 27 August 2026, states that "Personal Information may be transferred to and processed by Zapier in the United States and other jurisdictions where Zapier and its Subprocessors have operations", and on support that "A subset of our personnel have access to the products and to customer data via controlled interfaces." n8n's posture is cleanest and still not absolute: EU hosting plus US and UK affiliates listed as sub-processors "to provide and support the service". That page carried no last-updated date when this was written; it now does, reading "Last updated: September 22, 2026" when re-read on October 17, 2026.

Who can be compelled: it follows the company, not the rack

Read the last column against the second. Zapier is a US company storing data in the US: one jurisdiction, no ambiguity, the provision above applies directly. Microsoft lets a US buyer pick Germany or Sweden, but remains a US corporation, so that provision reaches records in its control wherever the rack is — which is why the EU Data Boundary is a set of engineering and contractual commitments, not a jurisdictional firewall.

Make is the interesting case. The Make service is Celonis, and Make's own DPA names "Celonis, Inc." as the entity EEA-domiciled customers contract with, while its GDPR page notes "Celonis Inc. is registered to the Data Privacy Framework (DPF)." A buyer who assumes the Czech support desk and the Irish database add up to a non-US posture has not read the DPA.

n8n self-hosted is the only configuration here where the answer to "who can be compelled" is you. That is not automatically better — your own counsel, your own process, no vendor to absorb the first request — but it is the only way to make the answer entirely yours.

What a US company should actually do

Read the DPA, not the security page. Security pages name encryption algorithms; DPAs and their annexes name entities, transfer mechanisms and notice periods. Make's country-level answer lived in a sub-processor PDF.

Pull the sub-processor list and read the location column. Not the names — the locations. That is where you learn the support desk or the AI provider sits somewhere the primary database does not.

Ask in writing where run history lives and for how long. Ask separately about logs and about backups, because as Zapier's own page shows, those are three different numbers.

Confirm whether support can access payloads. Zapier's DPA says a subset of personnel have access via controlled interfaces; Make's frames instance access as something the customer requests. Those are different postures, and you should know which one you bought.

Decide whether domicile matters here, and write down why. If you are a US business automating invoices and lead routing, a US vendor holding US data is exactly right. If you process EU personal data, or data under a contract promising a jurisdiction, answer that before go-live.

This is not legal advice

None of this is legal advice, and none of it assesses whether any product satisfies any regulation. Compliance belongs to the organisation deploying a tool, never to the tool: two companies can run the identical workflow and reach opposite conclusions about their obligations. This reports what four vendors published about location, retention and domicile. The comparison was compiled on 10 September 2026; where a page has moved since, the sentence says so and gives the date it was re-read. Nothing here has been re-verified wholesale, so treat any undated figure as of that first date and check the vendor's page before you rely on it.