Why we built CIQRA in the EU

The CIQRA team29 September 2026 7 min read

We built CIQRA in the EU because, for any business selling to European customers, the place where personal data is stored and processed decides which rules apply, which transfer mechanisms you depend on, and what you can honestly tell your customers. Hosting in the EU does not make a business compliant on its own, but it removes one of the least predictable variables from the equation. This post explains the reasoning, the legal history behind it, and the questions we think every merchant should ask of any platform.

Where data lives is a legal question, not a technical footnote

The General Data Protection Regulation (GDPR) treats sending personal data outside the European Economic Area as a special case. A transfer to another country is straightforward only when the European Commission has decided that the country offers an adequate level of protection, or when the exporter puts additional safeguards in place, such as standard contractual clauses.

For transfers to the United States, that ground has shifted repeatedly over the past decade:

  • October 2015: in Schrems I, the Court of Justice of the EU invalidated the Safe Harbor adequacy decision.
  • July 2020: in Schrems II, the Court invalidated its successor, the EU-U.S. Privacy Shield.
  • July 10, 2023: the Commission adopted a new adequacy decision for the EU-U.S. Data Privacy Framework, covering U.S. companies that participate in the framework.
  • September 3, 2025: the EU General Court dismissed an action to annul that decision (Case T-553/23, Latombe v Commission), confirming that the United States ensured an adequate level of protection on the date the decision was adopted.

The 2025 judgment is good news for transatlantic data flows. The same court press release also notes two things worth keeping in mind: the Commission must keep monitoring U.S. law and may suspend, amend or repeal the decision if that law changes, and the General Court's judgments can be appealed to the Court of Justice on points of law. In other words, the current framework is valid, but it has a history of being overturned, and it remains under review.

What happens when the ground moves

The cost of getting transfers wrong is not theoretical. In May 2023, Ireland's Data Protection Commission announced a fine of 1.2 billion euros against Meta Platforms Ireland and ordered it to suspend transfers of personal data to the United States. The regulator found that the company's transfers, made under standard contractual clauses with supplementary measures, did not address the risks identified by the Court of Justice in Schrems II. Under Article 83(5) of the GDPR, fines for infringements such as unlawful transfers can reach 20 million euros or 4% of total worldwide annual turnover, whichever is higher.

Most merchants will never face a regulator of that size. The lesson for a small or mid-sized business is simpler: if your platform's core data sits in a jurisdiction whose status can change by court ruling, your compliance position can change with it, through no action of your own.

Why that matters to a merchant, not just a lawyer

Europe is one of the largest online shopping markets in the world. According to Eurostat, 78% of internet users in the EU bought or ordered goods or services online in 2025. Those shoppers are protected by the GDPR wherever the seller is based, and a growing number of them read privacy notices, decline cookies, and ask where their data goes.

Selling across borders within the EU also brings its own obligations beyond data protection. Since July 1, 2021, the EU's VAT One Stop Shop has let businesses declare VAT on cross-border sales to consumers through a single registration, and an annual 10,000-euro threshold now also covers intra-EU distance sales of goods. Cross-border selling in Europe is an administrative discipline as much as a marketing one, and the data layer is part of that discipline.

A merchant who can say "your data is stored in the EU, and here is how it is protected" has a simpler story for customers, for business buyers doing vendor due diligence, and for their own records of processing.

EU hosting is necessary, not sufficient

It would be misleading to suggest that choosing an EU data center solves data protection. It does not. You still need a lawful basis for processing, accurate privacy notices, valid consent where consent is required, contracts with your processors, and a plan for data subject requests.

It is also worth being clear about what residency does not cover. When a store sends conversion data to an advertising or analytics platform, or connects a CRM, that data goes to the recipient's systems under the recipient's terms. EU hosting protects the data you hold; it does not change where your partners hold theirs. That is why consent has to come before tracking, and why every integration deserves its own review.

The cloud layer has moved in the same direction. In February 2025, Microsoft announced the completion of its EU Data Boundary, under which customers can store and process customer data and pseudonymized personal data for its core cloud services within the EU and EFTA regions. Infrastructure that is designed to keep data in Europe makes it easier for the platforms built on it to do the same.

Compliance as architecture

Being EU-hosted pushes decisions upstream, into the design of the platform rather than onto a checklist at the end. In practice that means a few principles:

  • Isolation by default. One customer's data should be kept apart from every other customer's at the database level, not only in application code.
  • Consent before tracking. Tracking cookies should not be set until a visitor opts in, and the consent choice should be recorded and passed on to ad platforms.
  • Secrets out of code. Keys and credentials belong in a managed vault and should be rotated.
  • Recoverability. Backups you can inspect before restoring, and the ability to return a database to an earlier point in time.
  • Accountability. Two-step sign-in, roles and permissions, and a record of who changed what.

When these are part of the structure, compliance stops being a scramble before an audit and becomes the way the system already works.

How CIQRA applies this

CIQRA is operated by CIQRA OÜ, based in Tallinn, Estonia. Store and site data is hosted in Microsoft Azure data centers in Germany, and AI text processing runs in the EU data zone. Each store's data is kept apart from every other store's at database level, and secrets are held in Azure Key Vault and rotated regularly. Backups can be previewed before they are restored, and the database can be recovered to an earlier point in time. Every plan includes cookie consent in 40 languages, with no tracking cookies until visitors opt in, consent records, Google Consent Mode v2 and support for the Global Privacy Control browser signal. Team sign-ins support two-step verification, with roles, permissions and a log of who changed what.

Questions to ask any e-commerce platform

  1. In which country, and with which cloud provider, is customer data stored and processed?
  2. Where does AI or other third-party processing of your content and customer data take place?
  3. How is one customer's data separated from another's?
  4. Can you restore a backup to a specific point in time, and preview it first?
  5. Are tracking cookies blocked until a visitor consents, and is consent recorded?
  6. Which integrations send data outside the EU, and under what terms?

Frequently asked questions

Does hosting in the EU make my store GDPR compliant?

No. It removes the need to rely on a transfer mechanism for the data your platform holds, but you remain responsible for lawful processing, consent, privacy notices and your own integrations.

Is it still legal to transfer personal data to the United States?

Yes, under the EU-U.S. Data Privacy Framework for participating U.S. companies, or with other safeguards such as standard contractual clauses. The General Court upheld the framework in September 2025, but the Commission keeps it under review and earlier frameworks were invalidated in 2015 and 2020.

Where is CIQRA data stored?

In Microsoft Azure data centers in Germany, with AI text processing in the EU data zone.

Sources

Share LinkedIn X Facebook Email

Written by
The CIQRA team

Related articles