Which AI Assistants Really Host in Germany?

An AI assistant for Microsoft 365 runs entirely in Germany only when storage, model processing, subprocessors and remote access all stay inside the border. amaiko stores in German data centers and processes AI exclusively within the EU. Most providers that advertise German hosting mean the first of those four points.

What does “hosted in Germany” mean for an AI assistant?

In practice the phrase covers four separate things. The first is storage, the place where documents, chats and the assistant’s memory sit at rest. The second is inference, the moment a model actually computes the prompt. Then come the subprocessors whose models the provider buys in, and finally remote access by the people who run support, operations and security.

A provider can get the first point right and cross the border on the second. Since this spring Microsoft allows exactly that by default for new tenants, and the documentation says so openly. Ask only about the data center and you get a correct answer to the wrong question.

Why isn’t the EU Data Boundary proof of German hosting?

Microsoft’s EU Data Boundary covers the 27 EU states plus Iceland, Liechtenstein, Norway and Switzerland. It commits to a region of 31 countries. Where a Microsoft 365 tenant actually sits follows the sign-up country, and customers with Multi-Geo capabilities fall out of the scope entirely, even when their tenant is listed in an EU country.

On top of that sit transfers that stay in place permanently. Data for consulting services lives in US data centers, and pseudonymized log data for security operations goes to any Azure region worldwide. Network traffic can run outside the border for a while to keep routing stable. None of this is hidden. It simply never comes up in the sales conversation.

Checkpoint	Microsoft 365 Copilot inside the EU Data Boundary	amaiko
Customer data storage	EU or EFTA, exact country follows the tenant’s sign-up location	German data centers
Model processing	with Flex Routing at peak load also United States, Canada or Australia	exclusively within the EU
Subprocessors	Anthropic processes customer data in the United States once the tenant allows those models	Azure OpenAI with processing inside the EU only; liberté handles every Mistral model and every token in the EU
Remote access and logs	security and support data consolidated worldwide, consulting data in US data centers	own isolated environment and databases per customer in Germany; access only within each user’s own Microsoft 365 permissions

Where does Microsoft 365 Copilot process your prompts since 25 March 2026?

Flex Routing lets Microsoft run LLM inference outside the EU Data Boundary during peak load. The documentation names the United States, Canada and Australia as possible locations. For tenants created after 25 March 2026 the feature is switched on by default. Older tenants find their starting value in the Message Center.

Switching it off takes two minutes. An administrator with the AI Administrator role opens the Copilot area in the Microsoft 365 Admin Center, goes to Settings, picks the option for flex routing during peak load periods and chooses the restrictive variant. Inference then stays inside the border even under load. The catch is how that information travelled, because Microsoft announced the starting value for older tenants only through the Message Center, and in an 80-person company nobody reads that feed systematically. Anyone who has not checked since April does not know their own setting. What that does to the GDPR assessment is covered in Copilot and GDPR 2026.

A second item belongs on the same list. If a tenant enables the Anthropic models for Microsoft’s generative services, Microsoft states that customer data is processed by Anthropic in the United States. Storage stays in the EU while the processing leaves it.

What evidence can you demand from a provider?

Demand everything an auditor would want to see. The list of subprocessors with their registered office and processing location belongs in that bundle, along with the data processing agreement and its technical and organizational measures. Ask as well which countries support and operations connect from.

Precision pays off on certifications. The BSI’s C5 criteria catalogue asks for the location of data processing as part of the system description and has auditors attest to it. The C5:2026 edition has been final since the end of March 2026 and covers 168 criteria across 17 topic areas. ISO 27001 documents a security management system and says nothing about where processing happens. For AI management systems the relevant standard is ISO/IEC 42001, which ISO 42001 and AI in Germany covers in detail.

How do you check an assistant in a single morning?

Put the draft contract and the provider’s security page side by side and answer the four questions in order. Where does the data rest, with the country named. Where does inference run, at peak and in normal operation. Which subprocessors are involved and where do they sit. Who reaches the systems from outside the EU, and under whose control. A vague answer is the answer.

With amaiko the first point lands on German data centers and the second on the EU; there is no hosting region to select. Teams that want European models on top of that book liberté, where every Mistral model and every token runs in the EU, without image generation. The persistent memory sits on the same servers, and AI with persistent memory on German servers describes the mechanics behind it.

amaiko costs €41.58 per user per month billed annually, and €33.25 from 200 users. Work out what that means for your team size in the pricing calculator. If you would rather walk through the four checkpoints together on your own tenant, book a demo and bring your IT along.

Frequently Asked Questions (FAQ)

Is a German data center enough for GDPR compliance?

A German storage location satisfies the requirement for where data rests. Lawfulness also depends on where the model runs and which subprocessors are involved, plus the question of who may reach the systems from outside the EU. Only once all four points sit inside the EU does the third-country transfer assessment under Art. 44 et seq. GDPR fall away.

Is Microsoft 365 Copilot inside the EU Data Boundary hosted in Germany?

The EU Data Boundary covers the 27 EU states plus Iceland, Liechtenstein, Norway and Switzerland. On its own it makes no promise about Germany in particular. That comes from Microsoft’s data residency commitments: for tenants whose default geography is Germany, Copilot interactions are also stored at rest in Germany, which says nothing about where inference runs. Customers with Multi-Geo capabilities fall out of the EU Data Boundary’s scope entirely.

What is Flex Routing and how do I switch it off?

Flex Routing lets Microsoft run LLM inference outside the EU Data Boundary during peak load, according to the documentation in the United States, Canada or Australia. For tenants created after 25 March 2026 the feature is on by default. An administrator with the AI Administrator role disables it in the Microsoft 365 Admin Center under Copilot, Settings, Flex routing during peak load periods.

Does Microsoft process customer data through Anthropic in the United States?

Once a tenant enables Anthropic models for Microsoft’s generative AI services, customer data is processed by Anthropic in the United States, according to Microsoft’s own documentation. Storage of that data stays inside the EU Data Boundary. The decision sits with the tenant administrator and belongs on every review checklist.

Where does amaiko store and process the data?

amaiko stores all data in German data centers and runs AI processing exclusively within the EU. The liberté plan handles every Mistral model and every token in the EU, fixed in the architecture and beyond the reach of any setting, and image generation is unavailable there.

Which certifications prove where processing happens?

The BSI’s C5 criteria catalogue asks for the location of data processing as part of the system description, and auditors verify it. The C5:2026 edition covers 168 criteria across 17 topic areas and has been final since the end of March 2026. ISO 27001 on its own says nothing about location.

What does amaiko cost per user?

amaiko costs €41.58 per user per month billed annually (€499 a year), or €49.90 billed monthly, so annual billing gives two months free. From 200 users it costs €33.25 a month billed annually, or €39.90 monthly. The smallest booking is five users.