By: KeyCrew Media
For European businesses, data residency has moved from an IT checklist to a procurement criterion. Passpack CEO Chris Skipworth explains why storage location and encryption design are separate questions.
When a European company evaluates software that touches sensitive data, “where does it live?” used to be a late-stage IT question. It increasingly comes first. Regulators, auditors, and enterprise customers now ask how vendors handle data, and small and mid-sized businesses (SMBs) are expected to have answers.
Credential management makes the point well. A password manager holds the keys to nearly every system a company runs, from banking portals and client accounts to HR platforms and cloud infrastructure. If the vendor’s infrastructure resides outside the buyer’s jurisdiction, the buyer may have a compliance problem they didn’t account for.
Why Location Became A Buying Criterion
Cross-border data transfers have been legally contested in Europe for years. The Court of Justice of the EU invalidated the Safe Harbor arrangement in 2015 and the EU-US Privacy Shield in its 2020 “Schrems II” ruling. The EU-US Data Privacy Framework, adopted in 2023, replaced Privacy Shield and survived a challenge at the General Court in September 2025. That ruling is now under appeal before the Court of Justice, which leaves some companies uncertain about relying on it.
Under GDPR, penalties for violations, including unlawful international transfers, can reach €20 million or 4% of global annual turnover, whichever is higher. Layered on top are sector rules and the NIS2 directive, which widened the range of organizations expected to manage supply-chain security.
For many procurement teams, the simplest answer is a vendor that serves European customers from European infrastructure.
That is the thinking behind Passpack’s expansion of its Amsterdam data center. “Our European customers should be served from a European base, not a US one,” said Chris. “Part of that is GDPR and how data is stored. But it’s also about quality of service: speed, access and backup.”
Residency And Encryption Are Different Layers
Residency does not replace sound encryption, and vendors that blur the two deserve scrutiny. Residency answers where data is held and which legal regime governs it. Encryption architecture answers who can read it.
“Where the data sits and who can read it are two separate questions,” Skipworth said. “The Amsterdam facility addresses the first. Our zero-knowledge design addresses the second, because credentials are encrypted before they reach us and only the customer holds the keys.”
Skipworth is candid about what the move is and isn’t. “It’s more of an infrastructure upgrade than a dramatic new feature,” he said. “But for a European customer, it matters.”
Questions Buyers Should Ask
Skipworth says buyers should put four questions to any security vendor before signing:
- “Where is our data stored and processed, and can you document it?” Skipworth says a vendor should answer this plainly and in writing. “If a vendor can’t tell you where your data lives, that’s a procurement red flag.”
- “Can you operate without being able to read our credentials?” For Skipworth, this is where zero-knowledge architecture earns its place. “If the vendor can read your passwords, you’re trusting their staff and their security, not just their software.”
- “What independent attestations do you hold?” He points to SOC 2 as a baseline. “Independent verification matters more than a vendor’s own claims.”
- “Does the product support the languages our workforce actually uses?” Skipworth says this one is often overlooked. “Tools people can’t comfortably use get worked around, and that undermines the security you paid for.”
Skipworth’s checklist reflects how Passpack approaches its own product: location, encryption, and usability are three separate checks, and a vendor should be able to answer all of them.
What It Means For SMBs
Smaller firms rarely have a dedicated compliance team, so they lean heavily on vendor choices to meet their obligations.
“A small business has the same obligations as a large one, but without a compliance department,” said Skipworth. “Enterprise-grade security shouldn’t be something only big companies can afford.”
The practical takeaway: treat storage location, encryption design, and usability as three separate checks, and get all three confirmed in writing before signing.
