All of Gradr now lives in the EU

Since 27 October 2026, all customer data at rest (every database, every file, every backup) lives exclusively on EU-owned infrastructure: Hetzner in Helsinki and Scaleway in Paris. There is no US parent company anywhere in the storage path, and we believe we are the only modern exam platform in Sweden that can make that claim.

Any vendor can write that customer data is stored in the EU. The claim only means something when the follow-up questions (where exactly, with whom, under whose jurisdiction) can be answered with a list rather than a footnote, so this post is that list, including one exception stated on our own terms: by default, our transient AI inference runs on Azure OpenAI in Sweden, and any customer can ask to have it routed to Scaleway in France instead. That is the only exception, and it gets its own section below.

The rest of the post documents the move itself: what left, what replaced it, and what it costs us to keep running, which is the part that never makes it into a vendor brochure.

The question in almost every meeting

For quite a while now, retaining all customer data within the EU has been the industry standard, one that any serious edtech company already adopts as a baseline. However, due to the legal and regulatory landscape shaped by Schrems II and the CLOUD Act, simply storing data at rest within the EU is no longer sufficient. Even if the physical servers are located in the EU, the involvement of a non-EU parent company can expose sensitive data to foreign jurisdictions, creating significant compliance risks for organizations handling personal data, particularly in the education sector.

This comes up in almost every meeting, whether we are talking to school management, a municipal IT department or a legal team: where are pupil data stored, and under whose jurisdiction? Grades, national exams, and personal data about minors are exactly the category where an inside-the-EU datacenter stops being a sufficient answer, because the real question is who can be compelled to hand data over, and by which government.

In practice, that means no AWS, GCP, Azure, Resend, Vercel, Cloudflare, Supabase, or basically any other service you would expect to see in a modern cloud stack.

Azure is the one name on that list that survives in our stack, and only for transient AI inference. It gets the full accounting promised in the introduction.

The tour: what lives where

Before the summer, our stack looked something like this:

• Supabase (database as a service)
• GCP (hosting and AI-inference)
• Azure (AI-inference)
• Resend (email delivery)
• Sentry (monitoring and error tracking)

Today, it looks like this:

• Hetzner (everything except AI-inference and backup storage)
• Scaleway (backup storage, AI-inference on request)
• Azure (AI-inference, default)

The list above means we now operate the primary application runtime, our databases, background jobs, CI/CD, object storage, an SMTP server for outbound email, and the observability stack (Sentry, Loki and Grafana), all self-hosted on Hetzner.

The migration happened in stages: hosting and the database left for Hetzner at the beginning of the summer, and observability followed during the summer months. In September we removed Vertex AI, the last Google service in our path, and in late October we deemed Scaleway ready for production inference, which means a customer can now have the entire data path, inference included, with EU-owned providers.

The observability stack spent a week or two screaming a bit louder than usual. That is why the move was scheduled for the middle of the summer: Swedish schools are on break, no exams are running, and a week of noisy monitoring matters least.

The cost of abandoning hyperscalers

The obvious reaction to the previous section is that our bill must have gone down, and it has: Hetzner is considerably cheaper than the hyperscaler stack it replaced. What replaced it on the cost side is the part nobody invoices you for. Patching, upgrades, backups and capacity planning for our own databases, observability, SMTP and CI/CD now add up to roughly five hours of engineering time a week, every week, and that operational burden is not offset by the savings on the bill.

Engineering has a well-earned stereotype about spending two weeks to save ten dollars. This was not that. Nobody moves a production stack over a summer to shave a line item: the move was a product decision, because the sovereignty is the product we sell, not a saving we found. Counted per hour of engineering time, hyperscalers are cheaper for most companies, and we see no reason why we would be the exception. We did it anyway, because the point was never the bill.

The asterisk: AI

The one exception, in full: our default AI-inference path runs on Azure OpenAI, processed in Sweden but under a US parent company, which means CLOUD Act exposure remains on the default path. The reason for this is a combination of:

• Azure provides more reliable and performant AI models
• AI-inference is transient processing rather than permanent storage, which limits the exposure window
• As of writing this post, we deem the risk of CLOUD Act exposure via Azure to be extremely low

However, the final routing decision is always made by the customer: if the geopolitical or legal situation changes, the switch is a database flag on our side rather than a migration project. A customer requests it, we walk through what it changes so the decision is an informed one, and the routing moves to Scaleway within the day.

In the future, we aim to make Scaleway the default AI-inference path once it can match Azure in terms of reliability, performance, and model availability.

note: Cost is not a primary reason we are staying on Azure. For most of our tasks, inference on Scaleway is actually cheaper.

From here, the direction is fixed and the pace is set by Scaleway: as its models mature, the default inference path moves over, and the asterisk shrinks with it. For the full picture of what lives where, including the interactive EU map, see our trust page.