Dear Derek,
Mendix processes all customer data in accordance with the European Data Protection Act or similar local legislation. Since Mendix has its statutory headquarters in the Netherlands, any data processed for Mendix's European and African customers is not subject to any threat from the US Patriot Act. With Mendix's confirmation to the European Data Protection Act and similar local legislation, Mendix ensures that no customer data originating from Europe or Africa will ever be stored in any other territory than Europe (or Africa).
I hope this answers your question. Should you have any additional questions relating to this subject, I'm more than happy to explain in more detail by phone - you can contact me by dialing to the Netherlands office or contacting your account manager.
Best regards, Wesley
Should be arranged on a per contract base by Mendix.
Remember that for eg. the Netherlands, European jurisdiction is OK.