Customer.io and GDPR: An EU Data Region Doesn't Remove the US Jurisdiction Problem

Customer.io is one of the most popular lifecycle email platforms among SaaS companies. It's built around behavioural data — onboarding sequences, trial-conversion nudges, dunning emails — which means it processes a lot of personal data about your users. For European teams, that makes the GDPR question unavoidable.

The short answer: Customer.io offers genuinely strong compliance tooling, including an EU data region, and it is more accommodating than many US competitors. But it is a US company, and that creates a structural jurisdiction exposure that choosing the EU region does not eliminate.

What Customer.io Gets Right

Customer.io (operated by Peaberry Software, Inc., based in Portland, Oregon) has invested more in data-protection infrastructure than most tools in its category:

• A choice of data regions. You can create your account in either a US or an EU region. If you pick the EU region, your customer data is stored in EU-based data centres rather than the US.
• A Data Processing Agreement covering Customer.io's role as a processor, with Standard Contractual Clauses (SCCs) for international transfers.
• Data Privacy Framework participation. Customer.io self-certifies under the EU-US Data Privacy Framework (DPF), the current legal mechanism for EU-to-US transfers.
• A published sub-processor list and a documented security program, including SOC 2 Type II attestation.
• Data subject request tooling — export and deletion capabilities to support DSARs, plus separate handling of transactional versus marketing consent.

If you configure it carefully — EU region, signed DPA, consent tracked properly — you can run Customer.io in a GDPR-aware way. Many European SaaS companies do exactly that.

Where the Compliance Gaps Are

The features above govern how data is collected and where it is stored. They do not change who has legal reach over the company holding it.

US Jurisdiction and the CLOUD Act

Customer.io is a US corporation. Under the US CLOUD Act (2018), US authorities can compel a US company to produce data in its possession or control, regardless of where that data is physically stored. Storing your data in the EU region reduces day-to-day transfer exposure, but it does not put the company beyond US jurisdiction.

This is the same structural issue we've covered for Mailchimp, HubSpot, and Salesforce: an EU data centre operated by a US-headquartered company is a data-residency improvement, not a jurisdiction fix. A Data Processing Agreement does not override US law.

Data Privacy Framework Fragility

The DPF is the legal basis Customer.io relies on for EU-US transfers where they occur. The concern is well documented: the DPF's two predecessors — Safe Harbor and Privacy Shield — were both struck down by the European Court of Justice, and the DPF itself faces ongoing legal challenges. If it is invalidated, arrangements built on it need a fallback. Our Schrems II checklist walks through what that means for a marketing stack.

The EU Region Helps — Within Limits

To be fair to Customer.io, the EU region is a real and useful control. For an EU controller, keeping subscriber and event data in EU data centres by default is meaningfully better than a tool that only processes in the US. The limit is jurisdictional, not geographic: the control addresses location of storage, while the CLOUD Act operates on nationality of the processor.

What This Means for Your Business

Using Customer.io is not illegal. No EU data protection authority has issued a blanket ruling against it the way several have against Google Analytics. But as the data controller, the compliance burden — and the residual risk — sits with you.

If you continue with Customer.io, you should at minimum:

• Create your account in the EU region so data is stored in the EU by default.
• Sign the DPA and keep your SCCs on file.
• Document your transfer risk assessment, acknowledging the US-jurisdiction and DPF-dependency factors.
• Track consent cleanly, keeping transactional and marketing streams separate.

The European Alternative

If your goal is to remove the US-jurisdiction factor entirely rather than mitigate it, the answer is a provider that is European-owned and EU-hosted, so neither the CLOUD Act nor the DPF is part of your risk model. We maintain a list of European alternatives to Customer.io built for SaaS lifecycle email, and a broader ranking of GDPR-compliant email marketing platforms with verified EU data hosting.

The trade-off is honest: some European tools match Customer.io's SaaS-specific lifecycle features closely, others prioritise breadth over depth. But for a European SaaS team where data sovereignty is a hard requirement, EU jurisdiction by design is a stronger position than EU storage by configuration.