EU-hosted scheduling: the questions to ask
EU-hosted scheduling: the data-residency questions to put to any vendor, and the answers a copy on your own server gives you.
There is a companion page in this series about what hosted in the EU means mechanically when you are the host. This one is the other half: the questions to put to a vendor, whoever is hosting, and what a copy on your own server answers by itself.
Nothing here is a ruling, and nothing here says any vendor satisfies anything. Where your own duties land is for you and your advisers. What follows is a list of questions with answers that can be checked, which is a different and more useful thing than a claim.
The questions
Which region is the application served from, and who chose it? A vendor answering the EU without naming a region or a provider is answering a marketing question. Ask which one, and ask whether you can choose.
Where is the database, and is it the same place? Application and data are frequently not colocated. Ask separately.
Where do the backups go, and how long are they kept? This is the question that most often changes the answer. A nightly dump to storage in another continent moves the data there every night, whatever the application's region says.
What is the mail path? Confirmations and reminders leave through something. Ask which provider, in which region, and whether the message body carries personal data.
Who are the sub-processors, and where is the list? A vendor with no list has not thought about it. A vendor whose list changes without notice has thought about it and decided in their favour.
What is in the access logs, and how long do they live? IP addresses and URLs are personal data in most readings, and log retention is rarely in a brochure.
What loads on the page from a third party? Fonts, analytics, chat widgets and error reporters each turn a visitor into a request to someone else. Ask for the list.
What happens to the data when the contract ends? Ask for the export format and the deletion timeline, in writing, before signing rather than after.
Who can read it for support purposes? Support access is normal and worth knowing about. Ask whether it is logged and whether you are told.
Where is the company, and which law governs the contract? A separate question from where the servers are, and both matter.
What a copy on your own server answers by itself
Several of those questions stop being questions.
The region is the one you rented, and your hosting invoice is the evidence.
The sub-processor chain is empty, because there is no vendor in the request path. Slotly and Rostera call nothing home, there is no licence check that phones out, and you hold the complete source, so that is something you can read rather than accept.
Try the Slotly demo ↗Live, on sample data, no sign-up.
The mail path is your own SMTP server. There is no relay and no sending service opening an account on your behalf.
Third-party assets on the page are whatever you added, which by default is nothing.
Support access is whoever you gave a login to.
Data at the end of the contract does not arise, because there is no contract to end and the database is already yours.
What does not stop being a question: the backups, the log retention, the hosting provider's own arrangements, and the calendar feeds. That last one is the honest nuance -- a token-guarded .ics feed is fetched by whichever calendar the subscriber uses, so a consumer calendar account polls it from wherever that provider runs. The feed is one way and revocable, and who subscribes is your decision, but it belongs in your own answer.
The two you still have to answer
Backups. Decide where they go before the first one runs, not after. Slotly's backups are taken from admin -- JSON with secrets redacted, or the raw database file -- and where you put them afterwards is the whole of the question.
Logs. Your web server writes them and your host keeps them. Find out for how long.
Questions people ask
Is self-hosting automatically better for a residency question? It moves the decision to you, which is usually better and is not automatic. A server in the right region with backups in the wrong one is still a cross-border flow.
Is it worth asking a vendor for this in writing? Asking in writing is how an answer becomes something you can point at later. Whether any particular answer is adequate for your situation is a question for you and your advisers, not for a software page.
Does the booking software send anything to its author? No. Nothing phones home, no licence check calls out, and the full source ships with it, so the claim is readable rather than assertable.
Where to look next
The product pages are Slotly and Rostera, each listing what it stores and what it deliberately does not. The side-by-side sets the booking half against the hosted services, and the alternatives page is one common starting point. For what those services charge, read the observatory: every figure is quoted verbatim beside the date it was read and a link to the page it came from. Prices are on the observatory; read them on the date shown there.