The question tends to arrive in one of three ways: a large customer's supplier vetting form, a tender from a Spanish public body, or your own board wanting a straight answer should the AEPD ever ask. Saying it is all in the cloud answers nothing. We build a map of every system your company relies on, where it is hosted, the sub-processors behind it and the safeguard each international transfer depends on. Then we relocate to Spain or another EU country whatever ought to live there. All of it is done remotely. Whether a transfer is lawful is for your data protection officer or your lawyer to judge; what we give them is technical evidence they can check.
Your ERP or mail platform seldom holds surprises, because its region is shown in the admin panel. Data slips out through the small things: the chat bubble on the website, a booking plugin, the e-signature tool, or a backup job someone set up years ago and never looked at again.
For each application we record the vendor, the region its instance runs in, the sub-processors it lists and the country its engineers log in from when they pick up a ticket. We also look at everything your website loads from third parties: analytics, advertising pixels, externally hosted fonts, WhatsApp and review widgets.
For each flow leaving the EEA we note the safeguard the vendor points to, be it an adequacy decision, standard contractual clauses or binding corporate rules, plus whatever supplementary measures it claims to apply. Your DPO uses this to update the record of processing activities and reach a view. We do not give legal opinions.
We check which geography the tenant was created in, what your licence actually lets you pin to a region, and which add-ons, connectors or AI assistants send content to other regions. Quite often we turn up third-party apps holding mailbox permissions that nobody remembers approving.
Depending on workload, budget and what your customers expect, we suggest a Spanish region of AWS, Azure or Google Cloud, or a European provider such as OVHcloud, Hetzner, Arsys or IONOS. The location of the building is only half of it; we also weigh the nationality of the parent company, which tenders ask about more and more.
A familiar pattern: the web shop sits on a server in Madrid while its backups land in a bucket in Virginia, as the setup wizard suggested that region and nobody changed it. We move the copies, switch on encryption, establish who controls the encryption keys and run a test restore before signing the job off.
Records, configuration and integrations are moved to a written plan that includes a rehearsal and a rollback route. After go-live we watch the new platform more closely for however long we agreed, then deliver current documentation along with the revised systems map.
Relocating is not always the answer. Occasionally one dropdown in a control panel does the job, sometimes a tool gets replaced, and sometimes the sensible call is to stay put and document the transfer properly. The timetable follows the inventory, never the other way round.
One table listing every system, its region, its sub-processors and which applications depend on which. Your DPO and management base the keep-or-move decisions on it.
Infrastructure is set up inside the EU, a copy of the data is loaded, and a handful of users spend a normal working day on it. Faults show up in rehearsal rather than first thing on a Monday.
Evenings or weekends, application by application. The previous platform stays running until you confirm that everything works, invoicing and integrations included.
Redundant subscriptions are cancelled to avoid paying for both platforms, ask the previous vendor to erase your data and hand you the updated map.
International transfers are rarely where people look for them. The contact form relays enquiries through a mailing service based outside Europe, the appointment software stores reminders in another region, the e-signature tool archives contracts across the Atlantic, and the statistics plugin installed “just to try it” is still switched on. That is why we start with the map rather than with picking a data centre.
No. Within the EEA personal data moves freely, and sending it further afield calls for an appropriate safeguard rather than being banned outright. Whether yours is good enough is a matter for your DPO or lawyer. In practice, the demand to keep everything in Europe, or even in Spain, usually comes from a big customer, a public tender or your own management, who have no wish to revisit it annually. Our part is to show the real technical picture and what changing it would cost.
It settles where the data is stored, but not everything else. Some services on the same cloud, such as global identity management or certain AI features, may process information in other regions, and engineers at the provider may log in from outside the EEA. The parent company also stays exactly where it is. We go through the specific services you use and the region restrictions each one supports, so your DPO can assess the whole picture.
Compliance with Spain's National Security Framework (ENS) is certified for the cloud service itself at a given category, so you need to check the certificate and what its scope covers. Apply holds no ENS certification and does not claim to. What we do is find certified services that suit your applications, estimate the effort of moving to them and prepare the technical part of your tender response.
Copies carry exactly the personal data found in the live system, so as a rule they fall under the same requirements. It is also the thing most often forgotten: production was brought back to Spain two years ago, yet the off-site copy still heads for another region. During the inventory we always check where copies are kept, whether encryption is on and who is genuinely in possession of the keys.
You have three options. Self-host an open source replacement inside the EU, which moves the spending from licences to administration. Separate the data so the foreign service only ever receives pseudonymised records or nothing that identifies a person. Or stay with the product and record the legal basis for the transfer thoroughly. The right choice turns on budget and on the legal assessment, and that view belongs to your DPO, not to us.
List the applications and services your company uses and, if you know it, where each one is hosted. We will reply within one working day with a proposal for the inventory and its price.
Your request is with us
Expect an answer within one working day. A reported fault that has halted your team is handled first.
No match found. Try another spelling, or go with the closest provincial capital: every job is done remotely, so the location makes no difference to what we deliver anywhere in Spain.
