You can use Vapi and still be GDPR compliant, but if your client requires EU-only data storage, hosting it on AWS EU servers or your own cloud is the safer option.