Where is the data hosted, and how does GDPR apply?
Exclusively in EU data centres on ISO 27001-certified infrastructure. Contract party and data processor is Conbool GmbH in Germany. The GDPR Art. 28 DPA is part of the contract and names the concrete data location.
According to the WeTransfer Trust Center, the service runs in multiple regions, with hosting options in the EU and the US. The contracting party is WeTransfer B.V., based in the Netherlands; Italy's Bending Spoons announced the acquisition in July 2024. For your GDPR assessment, what matters is which region is active for your account and which entity signs the contract.
Source: wetransfer.com / Trust Center. Please verify the concrete region for your account directly with the vendor.