Airtable publishes a data processing addendum incorporating the EU and UK Standard Contractual Clauses, maintains a subprocessor list, completes annual SOC 2 Type 2, ISO 27001 and ISO 27701 audits, and offers European data residency with its EU data centre in Frankfurt. The detail worth your attention is that European data residency at Airtable is partial, and Airtable names precisely what it does not cover.
This article covers where the addendum is, what the EU option does and does not move, what happens to data already sitting in the US, and the checks worth running before you describe any of this to a customer.
Where The DPA Is, And How It Attaches
Airtable's addendum is published at airtable.com/company/dpa and its subprocessor list at airtable.com/company/subprocessors.
The mechanism is deemed signature rather than execution. The addendum provides that by entering into it, the parties are deemed to be signing the UK Standard Contractual Clauses and their applicable tables and appendix information — the same pattern used across this cluster, and the same evidence problem. There is no countersigned artefact, so record which version you accepted and when.
On transfers, Airtable states it has incorporated both the EU Standard Contractual Clauses and the UK Standard Contractual Clauses into the addendum. On subprocessors, the addendum commits Airtable to imposing contractual obligations on each subprocessor substantially the same as those imposed on Airtable, before that subprocessor processes any customer personal data. If you need a refresher on what a processing contract has to contain before you assess this one, start with our guide to data processing agreements. We checked these pages on 7 August 2026.
European Data Residency Is Real, And It Is Partial
Airtable's EU data centre is hosted on AWS in Frankfurt, Germany. Backups sit in different availability zones within Frankfurt and in a separate AWS data centre in Ireland — so the backup story is EU too, which is more than many vendors document at all.
What moves to the EU is base content: all record-level data, attachments, and base history. For most teams that is the substance of what they worry about, and it is a genuine answer to a residency question.
Two operational details that make the option easier than expected. Customers do not need to be based in Europe to enable European Data Residency. And Airtable states that some functionality may be disabled for customers with residency enabled, pointing to its support documentation for the specifics — so check the feature list against how your team actually uses the product before you switch anything on.
What Stays In The United States, Named
This is the part to read twice, because Airtable is unusually specific and most summaries skip it.
Information collected by Airtable — user and authentication data, metadata, and support data — is stored in the US. Airtable's stated reason is that this is how it runs a global offering, and it points to the Standard Contractual Clauses in its addendum as the transfer mechanism covering it.
Beyond that, Airtable names particular base metadata held out of region: base and interface names, base descriptions along with colour and icon information, and base access request data.
Base names are the item to think about. A base called "Redundancy consultation — Q3" or "Candidates rejected after background check" is metadata that is itself revealing, and it sits in the US regardless of the residency setting. That is not a criticism of Airtable, which has documented it plainly. It is an argument for a naming convention, and it is the kind of specific that belongs in your record rather than a general note that residency is enabled.
Audit logs have their own rule. Enabling residency stores all new audit log data in the EU, while previously existing audit log data remains in the US and is purged after 180 days.
Switching Is Not Retroactive
If you already have data in the US and you turn residency on, nothing moves by itself. Airtable states that data already stored in the United States will not be automatically migrated, and that customers wanting to migrate should contact their Airtable representative, who will work with them to do it without data loss.
That has a practical consequence worth planning for. A team that enables residency after two years of use has some data in Frankfurt and some in Virginia, and the answer to "where is our Airtable data" is "both, until we run a migration." Warranting EU residency to a customer while a migration is outstanding is a claim your infrastructure does not yet support.
Subprocessors, Certifications And What To Verify
Airtable's subprocessor list is published, and its residency FAQ points there specifically for which subprocessors process data in the EU — a sensible place to start when a customer asks about the chain rather than the vendor. Our guide to subprocessor management covers how to review that list on a cadence rather than in a panic.
On assurances, Airtable states it completes annual SOC 2 Type 2, ISO 27001 and ISO 27701 audits, and that data is encrypted at rest and in transit. ISO 27701 is the privacy management standard and is less common than ISO 27001, so it is worth naming specifically when a buyer asks what independent assurance exists.
One thing to confirm directly rather than infer: which plans include European Data Residency. Airtable's own FAQ discusses enabling it in an enterprise context, and third-party summaries disagree with each other about the tier. Ask, name your plan when you ask, and get the answer in writing before it appears in a customer-facing document.
Common Mistakes With Airtable And GDPR
Describing residency as "our data is in the EU." Base content is. User and authentication data, metadata, support data and named base metadata are not. Say which, or say less.
Forgetting base and interface names travel. They are held outside the EU region by design. A descriptive base name is metadata that reveals its own subject, and a naming convention costs nothing.
Assuming enabling residency migrates existing data. It does not. Migration is a separate exercise arranged with Airtable, and until it runs your data is split across regions.
Ignoring the disabled-functionality note. Airtable states some features may be unavailable with residency enabled. Discovering which ones after switching is an avoidable conversation.
Treating a base as a spreadsheet. Bases hold customer records, candidate details and vendor contacts. That is a processing activity with a purpose, a basis and a retention period, and it belongs in your record of processing activities.
FAQ
Does Airtable offer EU data residency?
Yes, with a documented scope. Airtable's EU data centre is on AWS in Frankfurt, with backups in Frankfurt availability zones and a separate AWS data centre in Ireland. Base content — record-level data, attachments and base history — is stored in the EU. Other categories, described below, are not.
What Airtable data stays in the United States?
Airtable names them: user and authentication data, metadata, and support data. It also names base metadata held out of region — base and interface names, base descriptions with colour and icon information, and base access request data. Standard Contractual Clauses in Airtable's addendum are the stated transfer mechanism.
Will my existing data move to the EU automatically?
No. Airtable states that data already stored in the United States is not automatically migrated and that customers wanting to migrate should contact their Airtable representative, who will work with them to avoid data loss. Until then, expect data in both regions.
What certifications does Airtable hold?
Airtable states it completes annual SOC 2 Type 2, ISO 27001 and ISO 27701 audits, and encrypts data at rest and in transit. ISO 27701 covers privacy information management specifically, which is worth naming when a buyer asks about independent assurance rather than security alone.
Closing Thought
Data residency is sold as a switch and delivered as a boundary, and the interesting question is always where the boundary falls. Airtable deserves credit for drawing its clearly: here is what moves, here is what does not, here is the list of metadata that stays behind. Most vendors leave you to infer it.
The awkwardness is that a boundary you have not read is worse than no boundary, because it produces confident answers that turn out to be wrong under questioning. Your customers will ask you the same thing you should be asking Airtable — where does this live, and what did you leave out of that sentence. ComplyDog hosts a compliance portal on your own domain carrying your DPA, your subprocessor list, your data subject request intake and your security page. It will not run your migration. It will mean the careful version of the answer is written down once, instead of improvised each time.
