Finds cloud regions in your Terraform, Bicep and YAML that sit outside the EEA, and flags third-country transfers with no documented Chapter V basis. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
npmDocker Hubnpx @readystack/eu-data-residency-lint <file> docker run --rm -v "$PWD:/w" getreadystack/eu-data-residency-lint /w
Team? One key for every ReadyStack linter, 5 seats, $149 once
Sweep the whole repository in one command and keep a dated Chapter V transfer register in Markdown: every file, line, region, country and adequacy status in one document you can hand to an auditor.
One payment, one licence key for this tool. The key is shown right after payment.
External privacy counsel bills from $200/hour, and a Chapter V transfer review is billed by the file.
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.
Nineteen findings in ninety lines of Terraform, across six countries — that is the worked example shipped with EU Data Residency Lint, an ordinary CRM module of the kind a Berlin platform engineer reviews on a Tuesday. Eleven are errors. The countries: the United States, the United Kingdom, India, Brazil, Singapore, Japan. Nobody put them there on purpose.
backend "s3" { region = "us-east-1" }
provider "aws" { region = "eu-west-2" }
google_storage_bucket { location = "US" }The first is Virginia. The second is London: AWS named it eu-west-2 before Brexit and never renamed it, so it still reads as European in a pull request. The third is a Google Cloud multi-region spanning several American data centres.
Under GDPR Chapter V only the EEA — the EU 27 plus Iceland, Liechtenstein and Norway — is not a transfer at all. The United Kingdom and Switzerland sit outside it under a European Commission adequacy decision: lawful, but it has to be named in your Article 30 record. The United States is lawful only for organisations self-certified under the EU-US Data Privacy Framework. India, Brazil and Singapore have no adequacy decision, so they need standard contractual clauses plus a transfer impact assessment (Articles 46-49).
Article 83(5) prices that at up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher. Chapter V sits in that upper band.
Ask a code assistant for a bucket and it will often hand you us-east-1; ask whether eu-west-2 is in the EU and the name argues in its favour. Generic Terraform linters check syntax and cost, not the country a region sits in.
The lint resolves every region literal in Terraform, Bicep and YAML against a 64-region table covering AWS, Azure and Google Cloud.
Five cover plain placement: a US region, a third-country region, an adequacy-decision region, a Google Cloud multi-region location, a hardcoded zone like us-west-1b.
Five cover regions that hide: a state backend with its own region, a provider block with no region pinned (it falls back to AWS_DEFAULT_REGION, so the country is decided outside the repo), an aliased provider, a region read from an undefined variable, and a region literal missing from the table.
Five cover copies: replication destinations, DynamoDB global table replicas, secret replicas, log and backup destination ARNs, and edge functions that run at every point of presence on the planet. These survive residency reviews: the primary store is in eu-central-1 and everybody stops reading there.
Three cover evidence: no transfer basis named anywhere in the file, a US region with no Data Privacy Framework marker, and a non-EEA store with no customer-managed key.
The clean version of the same infrastructure, kept inside the EEA, returns 0 findings.
Scanning files is free and stays free: all 18 checks, no watermark, no counter, no time limit. Open a file, read the findings, fix the lines — that job finishes without a licence key.
The licence covers a different axis, ownership of the evidence. One command sweeps the workspace and writes a dated Markdown transfer register: every file, line, region, country and adequacy status in one document you commit and hand to an auditor. Privacy counsel bills from $200 an hour for Chapter V reviews, and the register is redone whenever the infrastructure changes. $29 once, one key per person or CI seat.
Run it in your browser: https://getreadystack.com/tools/eu-data-residency-lint
It reads Terraform, Bicep and YAML and resolves every cloud region literal to a country. Each region is scored against a 64-entry table as EEA, adequacy-decision, United States or third country, and 18 checks flag state backends, replicas, replication destinations, availability zones, log targets and provider blocks with no region pinned at all.
Platform and DevOps engineers at EU-established SaaS and fintech companies, and the data protection officers who review their infrastructure. If you are the person who has to answer "which country is this customer table in?" during a NIS2, DORA or ISO 27001 audit, the register is the answer sheet.
Chatbots write the very lines that cause the problem: ask one for an S3 bucket and it will often emit us-east-1. They also read eu-west-2 as European, when that region is London, outside the EEA since Brexit. Generic Terraform linters check syntax and cost, not the country a region sits in.
Scanning files is free forever, with no watermark and no usage counter: open a file, get all 18 checks, fix the lines. The licence covers the other axis, ownership of the evidence: a whole-repository sweep written to a dated Markdown transfer register you keep, version and attach to an audit.
Mapping regions to countries by hand means opening every .tf file and cross-referencing cloud region documentation. External privacy counsel bills from $200 an hour for Chapter V transfer reviews, and the register has to be redone every time the infrastructure changes. The extension is $29 once,.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. EU Data Residency Lint (Terraform, GDPR Ch. V) checks the file you open against 18 rules from a rule set dated 2026-09-14, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →