Plenty of PII anonymization tools now advertise "EU-hosted" or "GDPR-compliant infrastructure" as if that settles the question. It doesn't. The moment a tool needs to send your text to any server — even one sitting in Frankfurt — you've triggered a chain of GDPR obligations around cross-border transfer, subprocessors, and access control that "EU-hosted" alone does not discharge. The only architecture that sidesteps this chain entirely is one that never sends the data anywhere: 100% on-device processing.
The "EU-Hosted" Illusion
"EU-hosted" is a statement about a data center's postal address. It is not a statement about who can access the data inside it, which subprocessors touch it in transit, whether a support engineer outside the EEA can view a ticket attachment, or whether a foreign disclosure law can compel access to servers regardless of where they physically sit. A cloud PII tool that anonymizes documents by uploading them to a processing endpoint — however well-intentioned, however encrypted in transit — has still moved your unredacted personal data off your premises and onto infrastructure you do not control. Geography answers where the disk is. It does not answer who can reach it.
What GDPR Actually Requires: Articles 44-49
GDPR Chapter V — Articles 44 through 49 — governs any transfer of personal data to a third country or international organization, and sets the default posture as restrictive: transfers are only lawful if a valid mechanism applies. Article 45 permits transfers to countries the European Commission has recognized with an adequacy decision. Article 46 allows transfers where "appropriate safeguards" exist, most commonly Standard Contractual Clauses (SCCs) or Binding Corporate Rules. Neither mechanism is a one-time checkbox — both require an ongoing assessment of whether the destination country's laws actually protect the data once it arrives, a duty the Court of Justice of the European Union made unavoidable in 2020.
Schrems II and the End of the Easy Answer
On 16 July 2020, the CJEU ruled in Case C-311/18 (Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems) — widely known as "Schrems II." The court invalidated the EU-US Privacy Shield framework outright and held that SCCs alone are not sufficient if the receiving country's surveillance laws could override the contractual protections; controllers must assess the destination country's legal regime and add "supplementary measures" where needed. The ruling reshaped how every EU company evaluates a cloud vendor, regardless of contract paperwork.
The enforcement record since Schrems II shows this is not a theoretical risk. Ireland's Data Protection Commission fined Meta a record €1.2 billion in May 2023 specifically over EU-US personal data transfers found deficient even though SCCs were in place. In 2025, the same regulator fined TikTok €530 million over transfers of European user data to China. Both companies had legal teams, compliance budgets, and contractual paperwork most vendors' customers will never see the terms of — and both were fined anyway. A regulated business trusting a cloud PII vendor's "EU-hosted" claim inherits that same transfer risk with none of that leverage to fall back on.
Data Minimization: Article 5's Quiet Mandate
GDPR Article 5(1)(c) requires that personal data processing be "adequate, relevant and limited to what is necessary" — the minimization principle. Sending a full document full of names, national ID numbers, and medical or financial details to any external service, in order to run PII detection on it, is itself processing more data, in more places, than the task requires. The detection task is fundamentally a local text-transformation operation. Routing it through a network round-trip — even to a well-run, well-intentioned, EU-based processor — expands the surface area of the very risk the tool is supposed to reduce.
Read together, Articles 5 and 44-49 point to the same conclusion: the safest transfer is the one that never happens. If personal data never leaves the device, there is no transfer to justify under Chapter V, no subprocessor chain to audit, no SCCs to sign, no supplementary-measures memo to write and keep current as case law shifts.
Why 100% On-Device Processing Ends the Question
anonym.plus runs entirely on the local machine. PII detection is powered by Microsoft Presidio and spaCy, bundled directly into the desktop application — no API call to a hosted model, no document upload. Encryption operations use local AES-256-GCM with keys that never leave the device. An independent penetration test conducted in March 2026 confirmed zero outbound network calls during document processing. There is no account required for core use, and the application runs fully air-gapped: disable Wi-Fi entirely, and anonymization still works exactly the same.
This isn't a policy promise layered on top of a cloud architecture — it's a structural fact you can verify yourself with a network monitor. Because nothing is transmitted, GDPR's Chapter V transfer regime simply has no transfer to govern. There is no data center to certify as adequate, no jurisdiction whose surveillance laws need assessing, no SCC to draft and no supplementary measures to justify. The compliance question that Schrems II made unavoidable for cloud vendors doesn't arise in the first place.
Not Just for Government and Defense
Data-sovereignty requirements are usually discussed in the context of defense contractors or classified government workloads, but the underlying GDPR transfer rules apply to any organization processing personal data belonging to people in the EU — which is most regulated businesses, full stop. A mid-size law firm anonymizing case files before sharing with opposing counsel, a healthcare clinic redacting patient correspondence for a billing audit, a lender scrubbing loan applications before a fraud-model vendor demo, an HR team anonymizing an internal complaint file before an external investigation — none of these carry a classification stamp, but every one of them is handling Article 4(1) personal data and faces the identical Article 44-49 exposure the instant that data crosses toward a cloud vendor, "EU-hosted" or not. The fix isn't a niche defense requirement. It's the same fix for everyone: don't transfer the data in the first place.
Five Questions Worth Asking Any PII Tool Vendor
- Where does the actual detection and redaction computation run — on my device, or on your servers?
- What happens the instant my internet connection drops? If the tool stops working offline, it was never local to begin with.
- Who are your subprocessors, and in which countries do they operate? "EU-hosted" primary infrastructure can still sit behind a non-EU subprocessor for logging, monitoring, or support.
- Can I verify, independently, that no data leaves my network during processing? A vendor confident in its architecture should welcome you running a network monitor.
- If I'm audited, what do I actually show the regulator to prove no transfer occurred — a contract, or a network trace?
See how offline anonymization compares to cloud-based tools — check the comparison guide, or download anonym.plus and verify the "no network calls" claim yourself.