Every serious buyer asks where the data lives. Very few get an answer precise enough to be useful, because the question has more parts than it looks.
Here is the version I think you should be asking, of us and of anyone else.
Storage is the easy part
“Stored in the EU” usually means the primary database sits in a European region. Fine. Now ask the follow-up questions:
- Where do the backups go, and are they in the same jurisdiction?
- Is there read replication to another region for performance or disaster recovery?
- Where does your log and telemetry data go, and does it contain record contents?
- Which support tooling can see customer data, and where is it hosted?
- When an AI feature runs, where does inference happen and what is transmitted?
A vendor can truthfully say “your data is stored in Europe” while backups land elsewhere, logs flow to a US analytics provider, the support desk is a third-party tool with a view of your records, and inference goes wherever the model is cheapest.
None of that is necessarily malicious. It is what happens when a product is assembled from other people’s services and nobody re-asked the residency question after each addition.
Our answers, in order
Primary storage. Your Site’s database and files are on infrastructure we operate in Germany and the Netherlands.
Backups. Daily, held on separate infrastructure, also in Europe. Never replicated outside the EEA.
Replication. None outside Europe, for any reason, including disaster recovery.
Logs and telemetry. Operational only: request timing, error traces, queue depth. Not record contents, and not sent to a third-party analytics platform, because we do not use one.
Support tooling. There isn’t a third-party desk with a view of your records. Support access happens inside your Site, only when necessary, and is written to your audit trail.
AI inference. Only the specific records needed for a request are transmitted, on European endpoints where the provider offers them, under terms prohibiting training on transmitted content, with nothing retained after the response. The current provider is named on request and listed on our sub-processors page.
Isolation is a separate question
Residency tells you the country. Isolation tells you who else is in the room.
Many platforms are multi-tenant at the row level: one large database with a tenant column, and correctness depending on every query including the right filter. It performs well and it is how most SaaS is built. It also means a single missing clause in one query is a cross-customer data leak, which is a class of bug that has happened to well-run companies more than once.
Each Trivena Site has its own database and its own file storage. Separation is structural rather than a discipline applied to every query. On the larger plans you can have dedicated application and database capacity as well.
The parts we cannot claim
We do not hold ISO 27001 or SOC 2 today. We operate to the practices those standards describe, and we will pursue certification as the company grows, but we are not going to imply we hold something we do not.
If a certificate is a hard procurement requirement for you right now, we are not yet the right vendor, and I would rather tell you that on the first call than three months into an evaluation.
Why this matters more than it used to
A Dutch company putting its ledger, its personnel records and its customer list into software is making a bet on a supply chain it cannot inspect. The reasonable defence is not paranoia, it is specificity: ask about backups, replication, logs, support tooling and inference separately, and be suspicious when any of the five gets a vaguer answer than the others.
And ask what happens when you leave. Full export, open formats, at any time, no charge, is the answer you want. A vendor confident in the product does not need the data to be difficult to retrieve.
