Last month, while showing a prospect how visible they were in ChatGPT, I was asked which systems my software actually runs on.
“Uh, Google. Why?”
As I said it, I realised this was actually the weakest point in my whole presentation. Even though I work with very little personal data, the data I store about clients’ competitive position is sensitive market information.
That evening, I started counting how many times each AI scan relied on American systems: to retrieve data, process it, store it and provide the client dashboard. No fewer than six of the eight key tools I used ran through US tech giants. Apparently, even as a former privacy officer, I had blindly fallen into Google’s shiny trap.
“A data centre in Germany” does not solve everything
As a B2B marketer, Security or Procurement will probably ask where your marketing data is stored. You might think you are doing the right thing if it is on a server in Germany. But “our data is in Europe” can mean two different things—and that is where things often go wrong.
The company you contract with matters more than the physical location of its server. You want that company to be 100% European and not owned by an American parent company.
That may sound like legal nit-picking, but it is the heart of the matter. Under the US CLOUD Act, an American court can compel a US company to hand over data—even if it is physically stored on a drive in Frankfurt or Eemshaven. A data centre in Germany does not help in that case. What matters is the name of the company on your invoice.
A few years ago, you could get away with using a German data centre through AWS or Google. But the rules for data transfers to the US are constantly in flux, and a policy change in the US could make your data inaccessible in the blink of an eye.
What do I actually store about my clients?
When I started mapping all the data flows, personal data was not what worried me—I collect very little. In an AI measurement, I store the following about my clients:
- The specific questions asked of AI models on behalf of your brand.
- Your list of direct B2B competitors in AI.
- The full answer returned by each AI system.
- A detailed analysis: are you mentioned, in what context and with what sentiment; who takes your place; which sources does AI cite; how are you outperforming your competitors?
- A detailed technical scan of the website.
- As for personal data: exactly one email address per user to log into a personal dashboard.
Together, this gives a very clear picture of your B2B brand strategy. What are you investing in? Where are you vulnerable? Who is taking your market share in ChatGPT? This is highly commercially sensitive information. You simply want to know whose vault it is in.
Moving from the US to the EU
I decided to move my entire stack to sovereign European infrastructure. Here is what that looks like in practice:
| Function | Previous setup (US) | New setup (EU) |
|---|---|---|
| Running measurements | Google Cloud (US) | Scaleway (French company, server in Amsterdam) |
| Data storage | Google Sheets (US) | Scaleway Database (Amsterdam) |
| Dashboard login | Google account (US) | Own environment at app.handsongeo.com |
| Website and hosting | Strato (Germany) | Strato (Germany—it was already European) |
| Email and documents | Google Workspace (US) | Strato (Germany) |
| Payments | Manual invoice | Mollie (the Netherlands) |
| Analysis | Anthropic (US) | Mistral AI (France—considering a switch) |
What is still American?
Getting completely out of the US is simply not possible yet. The AI models I query are American. As long as my clients’ customers use ChatGPT, I cannot avoid it; I have to keep retrieving answers from it.
The difference lies in what I send there and what I do with it afterwards:
- I send only brand and product questions to the US, never personal data or internal business documents.
- All answers are stored on European servers.
- I still use Anthropic’s Claude to analyse those answers, but I am considering switching to French provider Mistral next year. I will only do so when Mistral’s output is as good as Claude’s, and I am testing that thoroughly.
Three questions to ask about your next marketing tool
Are you about to buy new AI software or analytics yourself? Avoid having Procurement or Legal block your project later. Ask your supplier these three questions upfront:
- “Which legal entity am I contracting with?” (And does that entity have an American parent company?)
- “Where is the database physically located, and which laws govern its owner?”
- “Exactly which of our business data do you store?”
My GEO tracker is now sorted. Measurements run in Amsterdam, email is hosted in Germany, and only the AI systems I query remain American. It took a few hours, but my clients and I no longer need to worry about whether I am really “100% European”.
This translation was made by AI.