Where Automation Data Lives: Make, Zapier, Israel

When an automation moves your customers' names, emails or messages between your tools, the automation platform handles that data, and the platform's servers are somewhere. Make lets an organization sit in a US or an EU data zone, and its own help page warns that an EU zone does not automatically keep every AI request in the EU. Zapier's documentation for Zapier MCP says customer data is stored in the US and that other regions are available only by agreement. Israeli law lets you send personal data abroad by consent, by an agreement with the recipient, or to certain states, and in every case it asks for a written undertaking from the recipient. So before you connect a customer database to a platform, ask four things: which region, which steps leave that region, what personal data passes through at all, and what the platform has promised in writing.

The Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001 set the rule in three steps:

• Regulation 1 bars sending personal data from an Israeli database to a database abroad, unless the law of the destination gives protection not lower than Israeli law.
• Regulation 2 lists the cases in which the transfer is allowed anyway. Three of them matter to a business that uses an online platform: the person the data is about agreed (item 1); the recipient committed, in an agreement with the database owner, to meet the conditions that apply to a database in Israel (item 4); or the recipient database is in a state that is a party to the European convention on protecting individuals in the automatic processing of data, a state that receives data from the EU member states on the same terms, or a state the Registrar of Databases named in the Official Gazette (item 8).
• Regulation 3 says that in a transfer under regulation 1 or 2 the database owner must get a written undertaking from the recipient to take sufficient measures to protect the privacy of the people concerned, and not to pass the data on.

Two things follow in plain terms. A platform's terms and data processing agreement are the natural place for that written undertaking, so ask for the agreement before you build on the platform. And “the servers are in the EU” helps, but it does not replace the written undertaking. This is our plain-language reading of the text, not legal advice.

Make's help page on AI providers and data zones says that “Your Data zone is the Make setting on your organization (US1, US2, EU1, EU2)”, and that the data region is where an AI provider actually processes a request. It then warns that selecting an EU zone “does not automatically mean every request gets processed and stays in the EU.” Some features it lists, among them all OpenAI models in Make's AI Provider, send the request to the US whatever the zone, and bringing your own AI provider connection “removes Make's EU guarantee entirely.”

The same page does not say where scenario data and execution logs are stored. We could not find an official Make page that does, so we cannot tell you. Check which zone your organization is in, and ask Make in writing where scenario data and logs are kept.

The page we could read is the security page of Zapier MCP. It says “Customer data is stored in AWS US-East 1 (United States)” and “Region-specific data residency is not available unless otherwise agreed.” That page is about one product, so ask Zapier for the account-wide statement and its data processing agreement before you rely on it.

1. Which region holds it? Get the zone or region of the organization in writing, not from a menu label.
2. Which steps leave that region? AI steps are the usual ones. A scenario can be in an EU zone and still send a message to a model that processes it in the US.
3. What personal data has to pass at all? Send the order number and the first name instead of the ID number, the full message thread or health details. Whatever the platform never receives cannot leave the country. This one costs nothing, and it is the most reliable.
4. What did the platform promise in writing? Ask for the data processing agreement and the list of sub-processors, and keep a copy with your records. If the platform is outside Israel, that agreement is the written undertaking that regulation 3 asks for.

Then tell your customers. Your privacy policy should name the processors you use and say that some process data outside Israel. If you hold a customer database, ask the vendor the same data question, and when an automation breaks covers what happens to a failed run that carried customer data.

We build automations on Make and other platforms, with a fixed price agreed before work starts, and we open the accounts in your name. Bring your list of tools to a free intro call and we will mark which steps carry personal data.

Can I use a US-hosted automation platform with Israeli customer data? Regulation 2 allows a transfer abroad in several cases, including an agreement in which the recipient undertakes to meet the conditions that apply in Israel, and regulation 3 asks for that undertaking in writing. Get the platform's data processing agreement. Ask a lawyer about your own case.

Does choosing an EU zone in Make keep all my data in the EU? Not for every feature. Make's help page says an EU zone does not automatically keep every AI request in the EU, and lists steps that always go to the US. It does not say where scenario data and logs are kept.

Is Zapier hosted in Israel or the EU? The Zapier MCP security page says customer data is stored in AWS US-East 1 and that other regions are available only by agreement. Ask Zapier what applies to your account.

• Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, regulations 1 to 3, Hebrew Wikisource, read on 22 October 2026. A transcription of the official text (Kovetz HaTakanot 5761, page 900); we did not check for a later amendment.
• AI providers and data zones in Make, Make Help Center, read on 22 October 2026.
• Security, Zapier MCP documentation, read on 22 October 2026.