“EU-hosted” is useful only when it names which data, which system, and which boundary. A social publishing service can store its application database in the European Union while still sending selected content and identifiers to processors or social networks outside the region.
That is not necessarily a contradiction. It is a reason to ask for precise language.
Separate four data paths
Application-controlled data
This can include Workspaces, users, connected account metadata, drafts, schedules, Post state, API keys, provider tokens, webhook configuration, and audit records. Ask where the primary database, object storage, queues, and backups live.
Service processors
Email, analytics, error monitoring, support, payments, content delivery, and infrastructure providers may receive subsets of the data. A regional database does not describe every processor. The privacy policy or processor list should name purpose and transfer basis.
Selected social providers
Publishing requires sending content, media, account identifiers, and authorization material to the network the user chose. The social provider then processes that data under its own systems and terms. An EU-hosted application cannot keep a Post inside the EU after the user directs it to a global social network.
The agent and its model provider
The writing context may be processed by a coding agent, model provider, local client, or another tool before it reaches the publishing service. This is a separate boundary from the scheduler. Keeping social OAuth tokens behind the publishing service reduces what needs to enter that context.
Questions that make a residency claim testable
- Which application data is stored in the EU?
- Where are backups, media objects, logs, and queues stored?
- Where are social provider OAuth tokens stored and refreshed?
- Which subprocessors receive account, content, diagnostic, or billing data?
- What transfers occur when a Post is sent to the selected network?
- How long do drafts, media, logs, and provider receipts remain?
- Can a user delete or revoke each category independently?
- Does the statement describe current production behavior or an intended architecture?
Residency is not the whole security model
Data location does not prove access control, encryption, credential isolation, safe retries, webhook authenticity, or human approval. Those controls need their own evidence. Likewise, strong security controls do not answer residency and processor questions.
The most credible trust page keeps these claims separate and uses narrow language that can remain true as infrastructure changes.
OpenPMM’s current disclosure distinguishes application-controlled storage from provider and processor transfers on OpenPMM Trust. OpenPMM also supports compatible agents through a hosted MCP server, with browser-based OAuth keeping the agent on the product boundary. The broader production-readiness checklist explains how to evaluate the rest of the operating contract.