Data residency
Your tenant runs in the region you pick at install. Backups stay in-region. LLM traffic respects your provider's residency.
Regions
At install you pick one of:
| Region | Data center |
|---|---|
| US-East | AWS us-east-1 |
| EU-West | AWS eu-west-1 (Dublin) |
| APAC | AWS ap-southeast-1 (Singapore) |
Sovereign customers can request other regions, including on-prem or sovereign cloud (e.g. AWS GovCloud, Azure for Germany, OCI Government). Get in touch if you need this.
What stays in region
- Your database — primary and replicas — never leaves the region.
- Object storage (file uploads, exports) — same.
- Backups — encrypted and held in the same region.
- Audit logs — same.
What can leave region
LLM traffic follows your provider's residency story. If you've configured Vertex with a regional pin (see Bring your own LLM), traffic stays in that region. If you point at OpenAI or Anthropic, their endpoints have their own residency posture — review their data-handling docs before assuming a region.
Customer-initiated exports (CSV, JSON) move data wherever you download them. That's expected; just be aware.
Failover
In-region multi-AZ failover is automatic. Cross-region failover is available on Operator and Sovereign plans for an additional warm-standby region. RTO under 1 hour, RPO under 5 minutes.
Sub-processors
Every sub-processor that touches tenant data is listed in the DPA at /legal/dpa along with the region they operate in.
Next
- SOC 2 controls — the compliance umbrella.
- Encryption & secrets — how data is protected at rest.