Where Do ChatGPT, Claude and Gemini Store Your Data? SG Guide

AI data residency at a glance (October 2026)

'Data residency' here means where your prompts, files and chat history are stored at rest. Where the model actually runs (inference) is a separate question and is often global. The table only includes options the vendors document themselves.

If your only reason to care is general PDPA compliance, residency is usually not required. If a client contract, regulator or tender asks for data to stay in Singapore, the options narrow quickly.

ChatGPT: Singapore data residency on Enterprise, Edu and API

OpenAI's announcement on expanding data residency to business customers worldwide lists Singapore among the supported regions, alongside Europe, the UK, the US, Canada, Japan, South Korea, India, Australia and the UAE. Its data residency help article adds the details.

• Who: new ChatGPT Enterprise and Edu workspaces, and eligible API customers. Business (the plan formerly called Team) is not included.
• What is stored in-region: conversations, uploaded files, custom GPTs, memory, canvas, code interpreter artifacts and image generation content.
• Cost: OpenAI says residency is included at no extra cost on Enterprise and Edu.
• Existing workspaces: residency is chosen when a workspace is set up; OpenAI's wording refers to new workspaces and new API projects.
• Inference: in-region model processing is a separate feature, available only in Europe and the US at the time of writing.

For API use, OpenAI says eligible projects created with a regional setting handle requests in-region. That suits a business building its own chatbot on OpenAI models with Singapore storage.

Claude: US storage, with regional options through cloud platforms

Anthropic's privacy centre answers the question directly in where are your servers located: traffic may be routed to the US, Europe, Asia and Australia, but data is stored in the US. That applies to Claude Free, Pro, Max, Team and Enterprise on claude.ai.

Developers using the Claude API can restrict where inference runs, but Anthropic's data residency documentation says the only workspace storage location currently available is the US.

For local storage, Anthropic points to cloud platforms. Its regional compliance page says regional endpoints through AWS Bedrock, Google Cloud Vertex and Microsoft Foundry can keep both storage and processing within a chosen region, including Singapore, and that regional pricing may be higher. This is a developer route, not a staff chat app.

Gemini and Microsoft 365 Copilot: what the data region settings cover

Google Workspace with Gemini

Google's data regions documentation includes Gemini app and Workspace with Gemini prompts and responses among the covered data. But the only locations are the United States and Europe, or 'No preference'. Business Standard, Business Plus and Enterprise Standard include storage-at-rest regions; Enterprise Plus adds processing controls. There is no Singapore option, and some features, such as image generation, switch off when processing is restricted.

Microsoft 365 Copilot

Microsoft's Copilot privacy page says Copilot was added to its data residency commitments in March 2024, and stored Copilot interactions follow the same rules as Exchange, SharePoint and OneDrive. However, the countries listed in Microsoft's Product Terms residency commitment and its Advanced Data Residency add-on do not include Singapore as of October 2026. Microsoft also notes that customers outside the EU may have queries processed in the US, EU or other regions.

Admins can see a tenant's current data location in the Microsoft 365 admin centre under Settings, Org settings, Organization profile, Data location.

What the PDPA says about storing AI data overseas

Section 26 of the PDPA, the Transfer Limitation Obligation, does not ban overseas storage. The PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026) explain that you may transfer personal data overseas if the recipient is bound by legally enforceable obligations, or holds a specified certification, giving the data protection comparable to the PDPA.

• A contract: must impose a standard of protection comparable to the PDPA and specify the countries and territories the data may go to.
• Binding corporate rules: for transfers within a corporate group.
• Certification: the recipient holds a Global or APEC CBPR certification (or, for data intermediaries, a PRP certification).
• Fallbacks: such as informed consent of the individual. The PDPC encourages organisations to rely on these only when the options above are not available.

In practice, for an SME using a business AI plan, the vendor's data processing agreement is the usual basis. Check that it lists where data may be stored and processed, and keep a copy. A personal account has no such agreement, which is a key reason to keep client data out of personal AI tools. The PDPC's guidelines on personal data in generative AI cover the other obligations.

DPA clauses to check before using an AI tool for client data

Read the vendor's data processing addendum (DPA) with these questions. If you cannot find the answers, ask the vendor in writing.

Residency and training are separate issues. A vendor can store data in Singapore and still use it for training on some plans; another can store in the US and never train on it. Our guide to AI training opt-out settings covers the training side, and our article on DeepSeek, Qwen and open models covers apps whose data goes to other jurisdictions.

Do it yourself or get help?

Start with a simple record: which AI tools your staff use, on which plan, where each stores data, and the contract that covers it. That record is what you would show the PDPC or a client asking about overseas transfers.

Our PDPA Compliance Pack (S$690) includes an AI use policy, an overseas transfer register for your tools and vendors, and the privacy notice wording to match. This guide is general information, not legal advice.