Sanbox By Sanlabs

Guides

EU, GDPR and data residency

Deutsche Fassung

Explainer

Where do my AI agent's model calls go? Claude, OpenAI and Mistral EU options

By the Sanbox team updated

Ask ChatGPT Ask Claude

Your agent's model calls go to the model provider and endpoint you configure; where the agent's computer runs doesn't change that. To keep inference in Europe, pick a European route: Claude through Amazon Bedrock or Google Cloud, OpenAI or Azure OpenAI with EU data residency, or Mistral's EU endpoint. Check each route's exact scope, because some include countries outside the EU. Anthropic's data residency docs list only global and us for its own Claude API (checked 6 November 2026). On Sanbox, the Computer and the gateway that forwards its model calls run in EU data centres, and you choose the endpoint, including custom OpenAI-compatible ones.

Why does the model endpoint matter most?

A model call carries whatever the agent has put in its context: your instructions, files it opened, command output, web pages, tickets. If any of that is personal data, the model provider processes it wherever its endpoint runs inference. Providers also separate where inference runs from where data is stored and where account metadata lives, so check all three.

Which EU options exist?

RouteWhere inference runsHow you select it
Claude API (Anthropic)global or usPer request or as a workspace default
Claude in Amazon BedrockEuropean AWS Regions; EU only if every destination Region is in the EUAn EU Region, with a regional endpoint or an eu. inference profile
Claude on Google Cloud's Agent PlatformEU member statesThe eu multi-region endpoint
OpenAI APIEEA and Switzerland, for eligible customersA Europe project and eu.api.openai.com
Azure OpenAI in Microsoft FoundryEU Data Boundary, which can include EFTA countries; or one EU regionA Data Zone (EU) deployment, or Standard in an EU region
MistralEU and EFTA countriesThe api.eu.mistral.ai endpoint

This summarises what the providers publish and isn't legal advice: your data protection officer or counsel decides which route is acceptable for your data.

Claude: use Bedrock or Google Cloud

  • Claude API. inference_geo accepts global (the default, any geography) and us. Workspace geo, which sets where data is stored at rest, is us only. Claude Platform on AWS and Claude Models on Google Cloud (Anthropic managed) use the same values, and for Claude in Microsoft Foundry Anthropic lists a US Data Zone, not an EU one.
  • Amazon Bedrock. Call Claude in an EU Region through a regional endpoint or an EU inference profile (model IDs with the eu. prefix). Global endpoints can route to any commercial Region. AWS's European Regions also include London (eu-west-2) and Zurich (eu-central-2), which are outside the EU, and AWS advises checking a profile's destination Regions with GetInferenceProfile instead of trusting the prefix. Regional endpoints cost 10% more.
  • Google Cloud's Agent Platform (formerly Vertex AI), Google managed. Use the eu multi-region, aiplatform.eu.rep.googleapis.com. Google says it keeps ML processing in EU member states, excluding the UK and Switzerland; the global endpoint gives no residency guarantee. Single-region endpoints such as europe-west1 serve only Claude Sonnet 4.6 and earlier. Multi-region and regional endpoints cost 10% more.

OpenAI and Azure OpenAI

  • OpenAI API. OpenAI offers regional storage and inference for Europe (EEA and Switzerland). Eligibility goes through OpenAI's sales team, and Europe requires Zero Data Retention, Modified Abuse Monitoring or another approved retention option. You pick the region when you create a project and send requests to eu.api.openai.com. Residency doesn't cover system data, some endpoints and features have exceptions, and models released on or after 5 March 2026 cost 10% more there.
  • Azure OpenAI in Microsoft Foundry. The deployment type decides. Global types may process prompts in any Azure region. Data Zone (EU) types process them within the EU Data Boundary, which can include EFTA countries such as Norway and Switzerland, and Microsoft's docs say regions can be added to a zone. Standard deployments process within the resource's Azure geography. For all types, stored data stays in the designated geography.

Mistral

Mistral's global endpoint, api.mistral.ai, is the default and makes no commitment on where inference runs. The EU endpoint, api.eu.mistral.ai, processes requests in EU and EFTA countries at 1.1 times list price. Account data, API keys, billing and usage metadata may still be handled elsewhere. Mistral stores data in the EU by default, but some features can temporarily transfer data to sub-processors outside the EU.

Does "EU" mean the same thing everywhere?

No. Google's eu multi-region covers EU member states only. AWS's eu- Regions include London and Zurich. Azure's EU Data Boundary can include Norway and Switzerland, OpenAI's Europe region covers the EEA and Switzerland, and Mistral's EU endpoint covers EU and EFTA countries. Each also lists exceptions, such as system data or control-plane metadata. Your data protection officer decides whether the differences matter.

How does Sanbox handle model calls?

A Sanbox Computer, its disk and the model gateway that forwards its calls run in EU data centres. Sanbox doesn't sell or host models: each template names a model provider connected with your organisation's own key, and the gateway forwards the agent's calls to it. Network access is deny-by-default, so apart from that provider a Computer reaches only the destinations in its network policy. After that, the endpoint you chose and your contract with that provider decide where a prompt goes.

To use an EU route with an OpenAI-compatible API, such as an Azure OpenAI Data Zone (EU) deployment, add it as a custom provider (owner or admin role):

printf '%s' "$AZURE_EU_KEY" | sanbox model-providers create --name azure-eu \
  --base-url https://<your-resource>.openai.azure.com/openai/v1 --api-key-stdin --json
sanbox model-providers models custom:azure-eu --json
sanbox templates create --name "EU agent" --model-provider custom:azure-eu --model <model-id> --json

The provider ID is custom:<name>. A route without an OpenAI-compatible API can sit behind a gateway you run in the EU; LiteLLM, for example, lists Bedrock, Vertex AI, Azure OpenAI and Mistral among its providers.

Agents you install yourself, such as Claude Code, call their own API hosts through the network policy instead. Claude Code's EU routes are Bedrock (CLAUDE_CODE_USE_BEDROCK=1 with an EU AWS_REGION) and Google Cloud (CLAUDE_CODE_USE_VERTEX=1 with CLOUD_ML_REGION=eu). In EU Regions it prefers eu. inference profiles, but its docs call that a preference, not a guarantee, so pin eu. model IDs and check /status. Leave api.anthropic.com out of the network policy, so a session without these settings can't reach the Claude API. Do this on a template whose own model provider isn't Anthropic, because the provider connection itself may allow that host.

Talk to us about running your agents in the EU.

When Sanbox is not the right fit

  • Prompts must not reach any model provider. Sanbox doesn't host models and has no GPUs. Run the model yourself, for example on a vLLM server, and connect it as a custom endpoint. Sanbox can also run in your own cloud or on your own hardware: write to sales@sanlabs.ai.
  • You want Sanbox to enforce a provider's region. Sanbox forwards calls to the endpoint you configure. It doesn't check what your provider contract covers or which features your provider excludes from residency.

Sources