A US hosting region does not establish where every customer record is handled
No; a hosting region describes where the website's servers run, not where every copy of customer information exists or is accessed. ICO guidance on international transfers treats making information available to a separate organization outside the country as relevant, including remote access, so support staff, email platforms and connected tools matter as much as server geography. Map each processing path and its location evidence before keeping the claim. Narrow or hold any promise that the map cannot support for every system it covers.
For: A research-only merchant whose privacy text or sales copy claims customer data is hosted, stored or kept in a particular country or region.
A region label answers one question about one system
Selecting a hosting region is a real configuration with a real meaning: the infrastructure provider runs your site in that location. What it does not establish is where customer records go afterward. Order notification emails leave through a mail service, support conversations live in a helpdesk, analytics and payment data go to their own providers, and backups may be stored by a different company in a different place.
ICO guidance on international transfers focuses on whether personal information is made available to a separate organization in another country, and remote access can count. A support agent in one country viewing records stored in another is a location fact your hosting label says nothing about. The same applies to a vendor's own staff accessing your account to provide the service.
This cuts in both directions. A hosting region does not prove a violation exists elsewhere, and it does not prove none exists. It is one verified fact about one system, and a geographic promise needs facts about all the systems the promise covers.
Map every path customer records actually take
List the systems that hold or touch customer information: the store database and its backups, the mail service carrying order emails, the support or helpdesk platform, the payment provider, any analytics or advertising integrations, and any exports staff keep. For each, record the organization responsible and the location evidence you actually have: the provider's documented processing locations, your account's configured region, or a clear statement in the agreement.
Vendor headquarters is not location evidence. A company headquartered in one country may process in many, and a global provider may offer region configuration you have not enabled. Record the evidence tier for each system: documented and configured, documented generally, or unknown. Unknown is a working finding, not a minor footnote.
Do not forget access geography alongside storage geography. For each vendor, record where its support or service personnel may access the data from, where the agreement says so. The ICO's framing treats that availability as part of the location picture even when the bytes never move.
Compare the promise with the map, system by system
Write out the exact published sentence and expand it into the systems it would have to cover. A claim that customer data is stored in one country must survive contact with your mail platform and helpdesk, not just your host. A claim that data never leaves a region must also account for remote access paths and any vendor whose processing location is unknown.
Classify each covered system as supported, contradicted or unresolved against the promise. A single contradiction or an unresolved core system is enough to hold a broad claim. Resist narrowing the claim silently in your head while the published text stays broad; the edit has to happen on the page.
Whether any particular arrangement is a lawful international transfer, and what safeguards apply, is a legal question for qualified review against the rules that govern your business and customers. This map supplies the factual inventory that review needs; it does not supply the legal answer.
Keep, narrow or hold the geographic statement
Where the map supports a precise statement, keep one that names what is actually true: for example, where the website is hosted, if that is the verified fact. Where the promise covers systems the map cannot confirm, narrow it to the supported systems or hold it until the vendor evidence exists. Replace absolutes with descriptions tied to named arrangements rather than with new vague reassurances.
Assign an owner to revisit the map when a vendor, plan, region setting or support arrangement changes, since any of those can quietly alter the location picture. Record the reviewed version and date so the claim's basis is traceable.
If you want a scoped Prism website review of a geographic data-handling claim, bring the published wording and a non-sensitive summary of the systems it covers; scope, responsibilities, fees and terms are confirmed before work. Vendor agreements, account identifiers and customer records stay out of the public inquiry.
Data-location evidence map
Complete the map for the systems your geographic claim covers before keeping or editing that claim. Record evidence tiers honestly; an unknown location blocks a broad promise. This map records facts; the legality of any transfer needs qualified review.
Worksheet entries are not submitted by Prism’s worksheet and are not saved by the site. Use record types, availability, anonymized observations, or match/mismatch results. Do not enter government identifiers, customer names or addresses, customer messages, receipt-access links, card or bank details, passwords, or keys. Send sensitive documents only through the provider’s verified secure channel.
Data-location evidence map. The last column is for temporary notes.
System or path
Location evidence to obtain
Why it matters
Your finding
Website hosting
Location evidence to obtainThe hosting provider's documented region for your actual plan and its configuration.
Why it mattersEstablishes the one fact a hosting region label genuinely supports.
Database backups
Location evidence to obtainWhere backups are stored and which organization holds them, from the backup owner's records.
Why it mattersBackups can live with a different provider in a different place than the live site.
Order and support email
Location evidence to obtainThe mail service carrying customer messages and its documented processing locations.
Why it mattersOrder emails leave the hosting environment; their handling needs its own evidence.
Helpdesk or support platform
Location evidence to obtainThe support system's storage location and where its staff access records from.
Why it mattersRemote access by a separate organization is part of the location picture.
Payment provider
Location evidence to obtainThe provider's documented data handling for your account, at the level its materials state.
Why it mattersA payment relationship is a separate processing path with its own geography.
Analytics and connected tools
Location evidence to obtainEach integration that receives customer information and its documented processing locations.
Why it mattersPlugins and tags can move data to organizations the hosting label does not describe.
Staff and vendor access geography
Location evidence to obtainWhere your own staff and vendors' support personnel are located when they access records.
Why it mattersAvailability from another country can matter even when storage stays put.
Claim decision
Location evidence to obtainThe exact published sentence compared against every row, with keep, narrow or hold recorded.
Why it mattersAn unresolved core row means the broad claim is held, not quietly kept.
These are temporary notes. Leaving or reloading this page may clear them. Worksheet entries are not sent automatically. If you copy notes into the consultation message and submit the form, Prism receives them as part of your request.
Limits
ICO international-transfer guidance is UK guidance; it frames why access and availability matter but does not decide the legality of your arrangements, which need qualified review under the rules that apply to you.
A hosting region neither proves full data residency nor proves a violation; it is one fact about one system.
Vendor headquarters, brand familiarity and plan names are not location evidence; use documented processing locations and your actual configuration.
Keep vendor agreements, account identifiers and customer records out of the worksheet and the public consultation form.
ICO: International transfers — checked 2026-10-01. Making personal information available to a separate organization outside the UK can constitute an international transfer, including through remote access. Hosting location alone proves neither full residency nor a violation.
Prism features — checked 2026-09-21. An agreed website review can cover store policies and business disclosures, with informational findings rather than legal opinions or compliance certification.