Where deal data is stored and where AI inference runs has become one of the first questions in any legal AI evaluation. Most firms get a fixed answer from their vendor. Emma’s standard setup now stores data and runs AI inference across the EU and the US, and a new data residency add-on lets firms choose the EU or the US for each new data room. That choice gives legal teams control, flexibility, and a clear answer for every deal.
"And what about our data?"
We hear it in almost every evaluation, and for good reason.
Each data room tells the story of a company: its shareholder agreements, financing terms, key customer contracts and litigation history. Most of it is confidential. All of it has to live somewhere.
What is data residency?
Data residency* is the umbrella term for the country or region where your data lives. For legal AI, it covers two things:
- Storage residency. Where your documents are kept at rest: the servers holding the files, database records, and backups. If a vendor says “we host in Frankfurt,” they’re usually talking about storage residency.
- Inference residency. Where AI inference runs: where the AI model reads and analyzes your documents. Every time the AI reviews a file, the content is sent to the servers running the model, so their location matters just as much.
The two don’t always sit in the same place. For instance, a provider can store your documents in Frankfurt (EU storage residency) and send them to a model in Virginia for analysis (US inference residency). So when you assess a legal AI tool, ask where your data is stored and where AI inference runs.
*We use “storage” and “AI inference” as technical terms. Legally, both count as “processing”: GDPR Article 4(2) defines processing as any operation performed on personal data.
What does allocated data residency mean?
With EU residency, storage and AI inference both stay on servers within the European Union, in line with GDPR limits on transfers outside the EU.
With US residency, storage and AI inference both stay on servers within the United States, which helps you meet requirements under the CCPA (California), HIPAA (Healthcare) and GLBA (Financial Services).
That’s different from our standard setup from now on, where data is stored and AI inference runs across the EU and the US, optimized for each transaction. Our subprocessor list shows where the data may go.
Why data residency matters
Firms usually come at the question from three directions:
- Their own policy. Information security rules set out where client data may go.
- Their clients' terms. Outside counsel guidelines can bar data from leaving a jurisdiction.¹
- Regulation. GDPR limits transfers of personal data outside the EU,² and sector rules add their own.
With enterprise AI, regional hosting has shifted from an exception to an expectation.
Who decides where your data lives?
The region is often fixed by the vendor: one region for everyone, or a setting negotiated case by case, at a price no one publishes. When someone else makes that call, the firm carries the impact. That’s why the real question isn’t just where your data lives. It’s who decides.
A fixed region works until a client asks for something else. Say a firm advises a European buyer who wants everything kept in the EU. The following week, it takes on a US fund that wants its data in the United States. With Emma’s data residency add-on, every deal team has the flexibility to select the required data residency per transaction, allowing both transactions to run with the same quality and security, no matter the region.
Choice puts the power back with the firm. It can answer clients with confidence, complete internal reviews faster, and take on work across jurisdictions from day one.
Emma's data residency expansion explained
Emma has stored data and run AI inference in the EU since day one. As our clients’ deals have become more international, Emma has grown with them. Our standard setup now stores data and runs AI inference across the EU and the US.
For Emma clients that need their data kept in one region per transaction, there’s now a data residency add-on feature. Firms can opt in when they sign their agreement with Emma, and from then on, every team chooses the required data residency each time a data room opens:
- EU Residency. Storage and AI inference in the European Union only.
- US Residency. Storage and AI inference in the United States only.
Every data room carries a tag showing its region, so your team and your clients always know where the deal data lives. If your firm needs one region for everything, an admin can lock it.
Your data. Your region. Same security: SOC 2 type II and ISO 27001 controls apply to every option, with GDPR controls in the EU, and your data is never used to train Emma’s intelligence. Every document is treated as confidential, privileged material included. It stays within your workspace, handled under the same controls.
How Emma handles personal data is set out in our Data Processing Agreement.
Just as Emma has always worked to your playbooks, request list, and checks, she now works to your hosting requirements too.
What does additional regional choice give your team?
- More control over confidential deal information. You decide where transaction data is stored and where AI inference runs.
- Alignment with client requirements. Meet clients’ geographical data-handling requirements without workarounds.
- Clear answers for every stakeholder. The moment a new data room is added, its data location is tagged, giving Legal, IT and InfoSec a clear answer and simplifying internal reviews.
- Flexibility across offices and jurisdictions. International teams can use the setup each client expects, all within one workspace.
- One less reason to wait on AI adoption. Data security is the barrier legal professionals cite most often when AI adoption stalls.³ With a choice of regions, residency is one less concern, so the conversation can focus on how Emma keeps your due diligence moving in sync with the deal.
The cost impact of regional data residency
Across enterprise AI, choosing a region usually comes at a price. Keeping data in a specific location means dedicated infrastructure, and many vendors pass that cost on, either as a regional surcharge or by reserving residency for a premium enterprise tier.
Emma keeps it simple. The data residency add-on is a flat 20% on your document-based pricing, agreed upon when you sign. From then on, your team can set any data room to the EU or the US, with no extra cost per deal.
The additional data residency feature can be added to every plan: Essentials, Professional, and Enterprise.
Your data. Your region. Now, your choice.
See how data residency fits each plan →
TL;DR
- Data residency is where your data is stored and where AI inference runs. For confidential deal data, it’s one of the first questions in any legal AI tool evaluation.
- Requirements come from three directions: your firm’s policy, your clients’ terms and regulation. They can differ from one deal to the next.
- The real power is choice. When the firm decides where its data lives, it can say yes to each client’s needs. Emma’s data residency options.
- The standard setup stores data and runs AI inference across the EU and the US, optimized for each transaction.
- Firms that need data kept in one region can add the data residency feature to their plan, then choose the EU or the US for each data room.
- SOC 2 Type II and ISO 27001 controls apply to every option, with GDPR controls in the EU.
- Pricing is simple: the data residency add-on is a flat 20% on your document-based pricing, agreed upon when you sign and available on every plan.
Sources
- Fox Rothschild, Privacy and Data Security Obligations: Law Firms Have an Outside Counsel Guidelines Problem.
- General Data Protection Regulation, Article 44: general principle for transfers to third countries.
- 8am, 2026 Legal Industry Report, March 2026. Survey of 1,300+ legal professionals: data security 46%, ethical issues 42%, privilege 39%.
Other related blog posts
