EU Data Sovereignty: What Fathom's EU Isolation Actually Means
Fathom is genuinely privacy-first and GDPR-compliant. But for EU-based businesses, there is an important distinction between GDPR compliance and EU data sovereignty, and Fathom sits firmly in the first category.
How Fathom's EU isolation works
Fathom has invested in what they call EU isolation: when a visitor from the EU lands on your site, their data is routed to European servers, where the IP address and User-Agent are immediately anonymized. No personal data crosses the Atlantic. This is a technically sound approach to GDPR compliance and a meaningful privacy protection.
The distinction is what happens next. Once anonymized, the data is transferred to and stored on Fathom's US servers. The company itself is Canadian, incorporated outside the EU, and subject to non-EU legal jurisdiction. The data at rest is in the US.
Why this matters for some EU businesses
For most businesses, Fathom's EU isolation is sufficient for GDPR compliance. No personal data leaves the EU, which is the core requirement. But for organisations with stricter internal data governance policies, public sector contracts, or clients who specify EU-only data storage in their agreements, the distinction matters.
Sublim stores all data in France, under French and EU legal jurisdiction, with no third-country transfers at any stage of the data lifecycle. If your compliance requirements go beyond GDPR minimums, that difference is material.



