'Where Is Our Data Actually Stored?' The No-Code Data Residency Audit
Official-source audit of 10 no-code platforms: where they store data, which subprocessors they list, and what public docs disclose. 24 July 2026.
Table of Contents
Audit date: 24 July 2026. Scope: Ten no-code platforms. Only statements supported by an accessible, current, official primary source are included. Where a page was JS-rendered and the full text could not be extracted, the accessible portion is cited.
---
Why this matters right now
The EU AI Act's transparency obligations under Article 50 apply from 2 August 2026. Here is what the article actually requires, drawn from the Official Journal text:
- Article 50(1): Providers must ensure AI systems intended to interact directly with natural persons are designed so those persons know they are interacting with an AI system, unless this is obvious to a reasonably well-informed, observant and circumspect person. This obligation does not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards.
- Article 50(2): Providers of AI systems that generate synthetic audio, image, video or text content must mark outputs in a machine-readable format as artificially generated or manipulated. This obligation does not apply where the AI system performs an assistive function for standard editing or does not substantially alter the input data, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.
- Article 50(3): Deployers of an emotion recognition system or a biometric categorisation system must inform the natural persons exposed to it.
- Article 50(4): Deployers of AI systems generating deep fakes must disclose the content has been artificially generated or manipulated. Deployers of AI systems that generate or manipulate text published on matters of public interest must disclose this, unless the content has undergone human review or editorial control and a natural or legal person holds editorial responsibility.
No-code platforms have been embedding AI features at pace. Whether a given feature sends your data to a model provider depends on implementation details most public documentation does not surface.
And procurement reviews are not slowing down. Someone is going to ask where your data actually lives. If you cannot answer, you cannot pass.
---
Airtable
Application data: Default hosting is AWS us-east-1. The GDPR support page states data is "hosted using US-based AWS servers (US-East-1)." EU data residency is available on Enterprise Scale, with data at rest in Frankfurt (eu-central-1), per the data residency page.
Subprocessors: The subprocessors page (last updated 31 March 2026) lists subprocessors including Anthropic, OpenAI, Google, IBM, and AWS. AWS and Google are listed with the country entry "Global."
Self-hosting: Not identified in materials reviewed.
DPA: Publicly available.
---
Bubble
Application data: Shared hosting is in the US, on Bubble-managed AWS. The hosting documentation states: "Bubble's shared server environment is hosted in the US, and we don't currently offer the possibility of changing that location." Dedicated plans allow region selection on an isolated, Bubble-managed instance.
Subprocessors: The subprocessors page lists Anthropic, Cohere, Google Cloud, and OpenAI as subprocessors that may process end-user data. The DPA references the subprocessors page for "functions and locations," but processing locations are not published on that page at the time of this review.
Self-hosting: Not identified in materials reviewed. Dedicated plans provide dedicated instances.
DPA: Publicly available.
---
Glide
Application data: Glide's security centre states: "We're hosted on Google Cloud Platform, and our servers are located in Iowa, USA."
Subprocessors: The subprocessors page (last modified 13 July 2026) lists subprocessors organised into three categories. The "Infrastructure Subprocessors" section includes entities described as providers of LLM-based artificial intelligence services: Anthropic, DeepSeek, Google (GCP, which Glide states is used for both storage and LLM access), Microsoft (Azure, for LLM services), Moonshot AI, OpenAI, and Z.ai. It also includes Airtable, AWS, Cloudinary, Courier, Mapbox, Mailgun, Sendgrid, and Zapier in infrastructure roles. Processing locations are not stated on this page for any subprocessor.
Self-hosting: Not documented in materials reviewed.
DPA: Publicly available.
---
Make
Application data: Make uses AWS with region options documented in a subprocessors list dated November 2025 (effective 12 December 2025). The document is a historical snapshot, not a representation of the current subprocessor inventory. As of the date stated on that document, AWS hosting location could be selected by the customer: United States, Germany (enterprise), or Ireland (others). MongoDB and Supabase rows also included geographic splits between EU and non-EU customers.
AI subprocessors: The same November 2025 document listed OpenAI (US), Anthropic (US, Irish legal entity), Google (US), Microsoft (France), and Groq (US) with explicit locations.
Self-hosting: Not publicly documented.
DPA: Publicly available.
---
n8n
Application data: n8n Cloud is hosted on Microsoft Azure in the European Union. The security page states: "The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union." Daily backups are replicated to a separate region in the same country.
Subprocessors: The subprocessors page lists Microsoft Azure (EU: Germany, Sweden), Hetzner Online (Germany), OpenAI (US), Anthropic (US), Google Vertex AI (EU, US), LangChain (US), and Daytona (described as a sandbox provider for AI Assistant, US).
Self-hosting: Yes. n8n's source code is available under the Sustainable Use License. Documentation is at docs.n8n.io.
DPA: Publicly available.
---
Retool
Application data: Retool Cloud runs on AWS, primary region us-west-2 for application and data storage. The outbound regions documentation states: "Outbound regions do not affect where Retool stores your applications or data." Self-hosted deployment is available.
Subprocessors: The subprocessors page (last updated 20 January 2026) lists infrastructure subprocessors (AWS, Temporal, Neon, Cloudflare), product-specific subprocessors for Retool AI Agents and Assist (OpenAI, Anthropic, Baseten, Tavily, ClickHouse), and other subprocessors (Intercom, Salesforce, Mailgun). All listed subprocessors show the United States as processing location.
Self-hosting: Available.
DPA: Publicly available.
---
Softr
Application data: Softr Platforms GmbH is a Berlin-based company. Its security page states: "We use Amazon Web Services (AWS) as our datacentre ... The datacentre is therefore located in Germany." The page states Softr aims to keep "as much data storage as possible inside the borders of the EU."
Subprocessors: The DPA references an Annex 3 for subprocessors. The DPA text itself does not list subprocessors. The DPA does not specify a hosting location; section 2.4 permits data processing outside the EEA under GDPR safeguards.
Self-hosting: Not documented in materials reviewed.
DPA: Publicly available.
---
Stacker
Application data: The privacy policy (last updated 22 February 2023) does not disclose a hosting region. It states: "Data transfers outside the European Union will not take place if you are located within a member state." It also states: "Depending on your location, data transfers may involve transferring and storing your information in a country other than your own."
Subprocessors: Not identified in the materials reviewed. The privacy policy does not list subprocessors. Pages at stacker.ai/legal/dpa, stacker.ai/legal/subprocessors, and stacker.ai/legal/security returned HTTP 404 on the audit date.
Self-hosting: Not documented in materials reviewed.
---
Webflow
Application data: The Webflow DPA states that Standard Webflow Hosting does not give customers a choice of hosting region. Webflow Custom Hosting, available on Enterprise plans, supports customer-chosen infrastructure and regions. Code export strips CMS, user accounts, ecommerce content, and dynamic functionality.
Subprocessors: The subprocessors page at webflow.com/legal/subprocessors was not accessible during this audit.
Self-hosting: Not identified in materials reviewed for a full-platform deployment. Code export produces static HTML/CSS/JS without CMS or backend.
DPA: Publicly available.
---
Zapier
Application data: The data privacy page states: "Zapier hosts data in AWS servers located in the United States." Region-specific data residency is not available unless otherwise agreed.
Subprocessors: The subprocessors page lists Anthropic, Fireworks AI, Microsoft, and OpenAI as subprocessors, all with the United States as processing location.
Self-hosting: Not identified in materials reviewed.
DPA: Publicly available.
---
What the public audit shows
These observations are drawn from the official materials reviewed on 24 July 2026 and reflect only what platforms choose to publish.
For builders with EU hosting requirements, n8n Cloud defaults to Azure EU hosting. Softr's security page claims AWS Germany hosting. Make's historical November 2025 document showed customer-selectable AWS regions. Airtable Enterprise Scale provides Frankfurt plus Dublin. Bubble requires a Dedicated plan for region selection. Glide, Retool Cloud, and Zapier are US-hosted without multi-region options in their standard plans.
On subprocessor transparency, Retool publishes entity-level locations for every listed subprocessor. n8n's subprocessors page provides explicit locations including "EU, US" for Google Vertex AI. Make's November 2025 document included entity-level locations. Airtable's subprocessors page lists providers with stated countries, with two marked as "Global." Glide's subprocessors page lists AI providers by function but does not state processing locations. Bubble's subprocessors page does not publish processing locations. Stacker's public materials did not identify subprocessors at the URLs reviewed on this date.
Two platforms, n8n and Retool, have current official documentation for customer-managed deployment.
---
What to ask your vendor
Send these questions and get answers that link to documentation:
- Where is my application data stored at rest? Get a specific cloud region, not "Europe." Can I choose my data region, and which plan do I need?
- Where are backups stored geographically? What are your documented RTO and RPO values?
- Do you publish a current subprocessor list? Give me the URL. Do you notify customers before adding subprocessors? Which subprocessors access customer content data?
- When I use your AI features, which model providers receive my data? Where is inference processed for each? Can I restrict AI processing to specific regions?
- What third-party certifications do you hold? What transfer mechanism covers cross-border data flows?
If a vendor cannot answer these with links to documentation, that is itself a finding for your risk assessment.
---
Where your database lives and where your AI prompts get processed are two separate questions. Do not accept the first answer as covering both.
Want to read
more articles
like these?
Become a NoCode Member and get access to our community, discounts and - of course - our latest articles delivered straight to your inbox twice a month!
