Methodology

The test: who can be legally compelled to hand over, intercept or cut off access to the data. The operator's jurisdiction counts for more than where the machines sit.

The operator rule

A part counts as EU when the company operating it, and its parent, are established in one of the 27 member states of the Union.
Switzerland, the United Kingdom, Norway, Iceland and Liechtenstein are labelled "Europe, outside the EU": shown as such, and counted as non-EU in the score.
A European brand owned by a non-European group counts as non-EU. A reseller of non-European infrastructure is classified by the network that actually serves the traffic.
A European operator serving from a data centre outside the EU stays EU: its legal reach runs through the European company. The IP address's location is shown alongside, for information.

The parts we check

API endpoint (for the AI providers in the list): the address your requests are sent to. When a CDN serves that address, it terminates the encrypted connection and sees requests and responses pass through.
Hosting: the domain's IP address, matched to the network announcing it (AS number), then to its operator.
Server location: the geolocation of that same IP address. It reflects physical placement, independently of the operator.
DNS: the domain's nameservers, matched by name, then by network.
Inbound mail: the MX servers. A domain without MX is not counted.
Outbound mail: the senders authorised by the SPF record. A sender already counted as an inbound server counts once.
CDN: identified from the homepage's response headers, counted when identified.
Services the page loads: third-party hosts the homepage loads (scripts, fonts, images, frames), read from its code. An operator present under several hosts counts once.
TLS certificate and registrar: shown for information, outside the score.

Score and verdict

The score is the share of counted parts operated from the EU: 5 of 6 gives 83.
The verdict is binary. "Stays in the EU" when every counted part is EU; "Leaves the EU" as soon as one is not. A site can show a high score and still leave the EU.
"Insufficient data" when nothing could be counted, for example a domain that does not resolve.

Sources

RIPEstat, run by the RIPE NCC in Amsterdam: the network announcing each IP address, the registration country of the address block, geolocation. The lookups themselves stay in the EU.
A provider database maintained by Bretelle: hostnames, AS numbers and HTTP headers matched to their operator and the country of its parent. When no provider matches, the network's registration country is used instead.
RDAP, through the IANA bootstrap registry, for the registrar; the certificate is read directly from the server.

Limits

Only the public edge is visible: what sits behind a proxy or load balancer is outside the check.
Services the page loads are read from the homepage's code as it loads. Those a script adds later, or that follow a visitor's action, can be missed.
Geolocation follows BGP routing; on an anycast network it often points to the operator's home country.
A result is kept for six hours, then recomputed. The check date is shown on every result.
The result is a technical indicator. A legal audit also examines contracts, sub-processors and internal flows.

Does something look wrong? Write to contact@bretelle.eu with the domain: the provider database is corrected and the result recomputed.