The short version
If you need your data stored in the EU by default, MailerLite and Moosend say they do, and Make lets you choose. Kit and beehiiv are US-based platforms whose subprocessors are listed in the US, and they rely on contractual or certified transfer mechanisms. None of this makes one vendor compliant and another not; it changes what you need to document.
The table uses only what each vendor publishes. Subprocessor locations in beehiiv's list are the locations the list gives for each company, which may be head offices rather than data centers. [9]
| Vendor | Documented storage | Region choice | DPA | Subprocessor list | Transfer mechanism |
|---|---|---|---|---|---|
| Make | US or EU data center [1]; zones US1, US2, EU1, EU2 [2] | Yes, at organization creation; cannot change [1] | Not linked from privacy notice [3] | Not published; list of recipients on request [3] | Notes transfers outside the EEA may occur [3] |
| MailerLite | Google Cloud in the EU: Germany (legacy) and Netherlands (new platform) [4] | No | Published [4] | In DPA Annex 4: Google Cloud EMEA, Vercom [4] | SCCs, UK Addendum, Swiss terms [4]; DPF for MailerLite, Inc. [5] |
| Moosend | Contact data hosted in the EU on AWS [7] | No | Not found on Trust Center [7] | Not found on Trust Center [7] | Not stated on Trust Center [7] |
| beehiiv | Hosting location not stated in DPA [8]; Amazon cloud hosting listed in USA [9] | No | Published [8] | Published, 15 days notice of changes [8] | SCCs, UK Addendum, Swiss terms [8] |
| Kit | US and other countries [11]; AWS hosting listed in USA [10] | No | Published [10] | In DPA Attachment 3 [10] | EU-U.S. DPF, SCCs, UK IDTA [10] |
Make: zones are chosen once
Make offers US and EU data center locations and asks you to pick one when you create an organization, recommending the one closest to you. It says the location reflects where the data center is, not where your company or users are, and that you cannot change it later. [1] Its AI providers page names the zones US1 and US2 for the US region and EU1 and EU2 for the EU region. [2]
The EU choice has limits for AI features. Make says selecting EU1 or EU2 does not automatically mean every request is processed and stays in the EU. All OpenAI models process in the US on both US and EU zones, some Claude models are served from a UK or US region even on EU zones, and bringing your own AI provider connection removes Make's EU guarantee. [2] If an EU-only rule matters to you, list which modules each scenario uses.
MailerLite and Moosend: EU storage by default
MailerLite's privacy policy says its data storage center is in the European Union. [5] Its DPA is more specific: it uses Google data storage in the EU, with a data center in Germany for the legacy platform and in the Netherlands for the new MailerLite, and lists Google Cloud EMEA (Dublin) and Vercom (Poznań) as subprocessors. [4] The same DPA lets MailerLite process data anywhere it, its affiliates or subprocessors operate, with SCCs for transfers to countries without adequacy, and names MailerLite, Inc. in San Francisco as the data importer. [4] Its help page adds that transactional account emails go through sister company MailerSend, with servers in Germany and Belgium. [6]
Moosend's Trust Center says customer contact data is hosted in the EU through Amazon Web Services and that encrypted backups are stored off-site. [7] The Trust Center page does not link a DPA or subprocessor list, so ask Moosend for both before you sign. [7]
Kit and beehiiv: US hosting with transfer safeguards
Kit's privacy policy says data is processed and stored in the United States and other countries. [11] Its DPA lists AWS and Amazon Redshift for hosting and storage, with every subprocessor processing in the USA, and relies on the EU-U.S. Data Privacy Framework, with SCCs (Module 2) and the UK IDTA where needed. [10]
beehiiv's DPA does not state where data is hosted. It points to a published subprocessor list, promises at least 15 days notice before a new subprocessor gets access, and uses SCCs Module 2 for the service plus UK and Swiss variants. [8] The list includes Amazon for cloud hosting, Crunchy Data and ClickHouse Cloud for database hosting, and SendGrid for email, all with US locations given. [9]
What an EU small business should check
The EDPB's guide for small businesses sets out the checks. If the recipient is in a country with an adequacy decision, the transfer is treated like one within the EEA, and for the US that adequacy only covers companies participating in the EU-U.S. Data Privacy Framework, so confirm participation. [12] Without adequacy, Standard Contractual Clauses are a common safeguard, with a transfer impact assessment. Whatever the mechanism, a processor still needs a contract with you. [12]
- Download and keep the vendor's DPA with the date you accepted it.
- Save a copy of the subprocessor list and subscribe to change notices where offered. [8]
- Record which transfer mechanism applies: adequacy via DPF, SCCs, or both. [10] [12]
- For Make, record the organization's region and which AI modules each scenario uses. [1] [2]
- Check where integrated tools store data, since each integration is another recipient.
- Add the vendor to your record of processing and privacy notice.
Questions before you decide
Can I move my Make organization from the US to the EU?
No. Make says you select the data center location when you create an organization and cannot change it afterwards. To switch, create a new organization in the other region and import your scenarios as blueprints.
Does choosing Make's EU zone keep all processing in the EU?
Not for every feature. Make's AI providers page says selecting EU1 or EU2 does not automatically mean every request is processed in the EU, all OpenAI models process in the US, and bringing your own AI provider connection removes Make's EU guarantee.
Where does MailerLite store data?
MailerLite's DPA says it uses Google data storage in the EU, naming Germany for its legacy platform and the Netherlands for the new one. Its DPA also lists Vercom in Poland as a subprocessor and allows transfers under SCCs.
What should an EU business check when a vendor is US-based?
The EDPB SME guide says to check whether a US recipient participates in the EU-U.S. Data Privacy Framework, otherwise rely on safeguards such as SCCs with a transfer impact assessment, and to have a processor contract in place.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Make Help Center: Organizations Accessed 30 Oct 2026
- Make Help Center: AI providers and data zones in Make Accessed 30 Oct 2026
- Make: Privacy notice Accessed 30 Oct 2026
- MailerLite: Data Processing Agreement Accessed 30 Oct 2026
- MailerLite: Privacy policy Accessed 30 Oct 2026
- MailerLite: Is my data safe with MailerLite? Accessed 30 Oct 2026
- Moosend: Trust Center Accessed 30 Oct 2026
- beehiiv: Data Protection Addendum Accessed 30 Oct 2026
- beehiiv: Sub-processor list Accessed 30 Oct 2026
- Kit: Data Processing Addendum Accessed 30 Oct 2026
- Kit: Privacy policy Accessed 30 Oct 2026
- EDPB: SME guide, international data transfers Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.