EU-hosted coaching software
By Martijn Mauritz · Last updated 2026-09-06
What is EU-hosted coaching software?
EU-hosted coaching software stores and processes client data inside the European Union, under EU jurisdiction and the GDPR, rather than on US-based infrastructure. Exantur keeps personal data in the EU, encrypted in transit and at rest, with any US sub-processors operating under EU Standard Contractual Clauses.
For many European coaches and organizations, where the data lives is a decision in itself. US-based coaching platforms store client data under US jurisdiction, which raises questions about foreign access requests and cross-border transfers that a European practice would often rather not carry. Exantur keeps it in the European Union.
Coaching data is unusually sensitive. Session notes touch on someone's career, their relationships, their setbacks and their ambitions, the material people share precisely because they trust it will stay private. For a coach, being able to say plainly that a client's data sits in the EU, under EU law, is not a technical footnote: it is part of the trust the relationship runs on. This page explains what EU hosting means in Exantur, what it settles, and, just as importantly, what it does not.
It forms part of Exantur, coaching practice management software created for how professional coaching actually works, instead of a generic project management app adapted after the fact.
What is EU-hosted coaching software?
EU-hosted coaching software stores and processes client data inside the European Union, under EU jurisdiction and the GDPR, rather than on US-based infrastructure. Exantur keeps personal data in the EU, encrypted in transit and at rest, with any US sub-processors operating under EU Standard Contractual Clauses.
Data stays in the EU
All personal data is stored in the European Union, encrypted in transit (TLS) and at rest. The few US sub-processors we rely on (such as Stripe for payments and Cloudflare for hosting) operate under EU Standard Contractual Clauses and are listed in our privacy policy.
Residency is not something you have to configure or pay extra for. It is the default for every account, so there is no European tier to opt into and no risk that data quietly lands on US infrastructure because of a setting you missed. The optional AI assistant, which is a paid add-on that is off by default and opt-in, is built so that no client-identifying data is sent to the model, and it runs on the coach's own Anthropic key rather than pooling data across accounts.
A European company by design
Exantur is built by a small European team. EU data residency is not a configuration option bolted on for European customers, it is how the platform is built.
The access controls that protect it
Residency answers where the data is; access control answers who can reach it. Access is enforced at the database layer with row-level security, coach-private notes are never exposed to coachees, and multi-factor authentication is required by default for administrators. The full security model is on our secure coaching software page; for your GDPR obligations and a DPA, see GDPR coaching software.
Reassurance you can pass on to clients
EU residency is only useful if you can explain it. When a client asks where their data goes, or when an organization's procurement team runs a vendor check, a coach needs a clear answer, not a shrug. Exantur gives you the concrete facts to hand over: data stored and processed in the EU, encryption in transit and at rest, a Data Processing Agreement available on request, and a named list of sub-processors in the privacy policy.
This matters most in regulated or privacy-sensitive settings, and for coaches working with organizations whose own GDPR obligations flow down to their suppliers. Being able to point to EU hosting and a signed DPA turns a vague worry into a documented answer, which is often what a serious client or an L&D buyer is actually looking for before they commit.
What EU hosting does and does not settle
EU hosting keeps client data under EU jurisdiction and removes the US-jurisdiction question that comes with many international tools, which is a real part of a defensible privacy posture. It does not, on its own, make a practice GDPR-compliant: you remain the data controller, responsible for lawful basis, informing clients and honouring their rights. Exantur provides the EU residency, the access controls and a Data Processing Agreement; the compliance obligations that sit with you are covered on the GDPR coaching software page. Honest about the line between what the platform does and what stays yours.
Frequently asked questions
- Is any data stored outside the EU?
- Personal data is stored in the EU. The few sub-processors involved (such as Stripe for payments and Cloudflare for hosting) operate under EU Standard Contractual Clauses; optional AI features send relevant context to a processor under a data processing agreement, and are opt-in and off by default.
- Why does EU hosting matter?
- It keeps client data under EU jurisdiction and the GDPR, which matters for European coaches, organizations and the clients who trust them. Where the data lives is a residency question; your GDPR obligations are covered on our GDPR coaching software page.
- Does EU hosting make me GDPR-compliant?
- No. It is a necessary part, but you remain the data controller. Exantur provides EU residency, access controls and a DPA; your obligations (lawful basis, informing clients, honouring their rights) are covered on the GDPR coaching software page.
- Do the optional AI features send client data outside the EU?
- The AI assistant is a paid add-on that is off by default and opt-in. It is built so that no client-identifying data is sent to the model, and it runs on the coach's own Anthropic key. If you never turn it on, it plays no part in how your data is handled.
- Can I get the details to satisfy a client or an organization's procurement check?
- Yes. You can point to EU storage and processing, encryption in transit and at rest, a Data Processing Agreement available on request, and the named sub-processor list in the privacy policy, which is usually what a privacy-conscious client or L&D buyer wants to see.