Where is the data hosted, and how does GDPR apply?
Exclusively in EU data centres on ISO 27001-certified infrastructure. Contract party and data processor is Conbool GmbH in Germany. The GDPR Art. 28 DPA is part of the contract and names the concrete data location.
According to the WeTransfer Trust Center, the service runs in multiple regions, with hosting options in the EU and the US. The provider is WeTransfer B.V., based in the Netherlands. For your GDPR assessment, what matters is which region is active for your account and which contract party signs.
Source: wetransfer.com / Trust Center. Please verify the concrete region for your account directly with the vendor.