In the EU. Cited's database, authentication, and storage run on infrastructure hosted in Ireland, so your core data is resident in the European Union. Some providers that help run the service are outside the EU, mainly in the US, and those transfers are protected by standard legal safeguards. These details come from the published Privacy Policy.
Core data is EU-resident
Your core account and platform data sits on Supabase infrastructure hosted in Ireland, covering the database, authentication, and storage. Automation runs on DigitalOcean in Amsterdam, also in the EU. For EU buyers especially, that data residency is often a requirement, and it is the default here rather than an upgrade.
How transfers outside the EU are handled
Running a modern service means using some providers based elsewhere, mainly in the US, for things like payments and the AI processing itself. When data leaves the EU, Cited relies on two recognized safeguards: the EU-US Data Privacy Framework, where a provider is certified under it, or the European Commission's Standard Contractual Clauses.
These are the standard legal mechanisms for protecting international data transfers under GDPR, with further measures like encryption where needed.
What is not done with your data
Two reassurances worth stating plainly. Cited does not sell your personal data, and it does not use your content or personal data to train general-purpose AI models. Its AI providers, used through their business tiers, commit not to train their general models on data sent through their APIs.
Where to go next
For the full picture, read is Cited legit: trust, security, and privacy. For compliance specifics, see is Cited GDPR compliant.
