This is the comparison most existing content skips entirely. A Thai business handling customer data under the Personal Data Protection Act needs to know where that data physically lands. None of the five tools compared here offers a Thailand storage option, and wherever a vendor publishes any regional choice at all, Thailand simply is not on it.
Per vendor, what is actually published. Anthropic runs all Claude inference on US infrastructure and offers no data residency option for any tier, consumer or business; the default retention is 30 days unless a contract states otherwise. OpenAI's residency programme, for eligible Enterprise, Edu, Healthcare and API customers, lets you pin storage to the US, Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India or the UAE, ten regions in total, and Thailand is not one of them, so consumer ChatGPT and anyone outside that eligible list defaults to US processing. Google Workspace's Gemini, on the Enterprise Plus tier with its Assured Controls add-on, lets an admin pin storage to the EU or the US at the org-unit level, and again Thailand is not a choice, only those two. Microsoft's Advanced Data Residency programme lists Local Region Geography countries including Malaysia, Indonesia, Japan, South Korea, India, Taiwan and Australia, but not Thailand, and no dedicated Microsoft datacentre region is confirmed for Thailand, so a Thailand-created tenant most likely resolves to the nearest Asia-Pacific region, commonly reported as Singapore, though we could not confirm that exact placement directly. Perplexity's API layer states a zero-data-retention policy, prompts deleted immediately after the request, but we found no named storage-region choice for its consumer plans.
What this means in practice is not 'do not use these tools.' It means the cross-border transfer rules in Sections 28 and 29 of the PDPA apply to every one of the five, by default, all the time. Our companion guide, linked below, reads exactly what those sections require, an adequate destination, a certified group policy, or documented suitable protection measures, and states plainly what we could and could not confirm about a published country whitelist.