Data residency
Most trust centers answer where the database is and stop. A compliance team is asking five things, and in 2026 the third one — where inference happens, and under whose contract — is the one that stops deals.
Reviewed 2026-08-28
Five questions, five answers
What is true today
The primary control-plane database is configured in AWS us-east-2. EU database residency is not available today, and no availability date is committed on this page. Hosting, object storage, email, and inference locations are stated separately because they do not share one residency boundary.
Deployment boundary mapEgress, inference, and residency.
Computed when served · reviewed Runtime-derived egress decisions lead to the deployment-selected model configuration. Provider availability is not checked, and organization-owned selections are private. Five residency answers follow; the tables retain every value as authoritative accessible detail.
Fail-closed gateCurrent egress decisions
- publicpermitted
non-restricted-egress-permitted - internalpermitted
non-restricted-egress-permitted - restrictedrefused
restricted-egress-denied
Selected by this deploymentmanaged-frontier
- Inference boundary
- external-managed
- Cost boundary
- variable-token
- Raw-data policy
- provider-policy
- Configuration
- configured · provider not checked
A managed frontier provider outside the customer boundary. Restricted payloads are denied to it unless the deployment explicitly opts in.
Separately stated boundaries5 current residency answers
- Primary database
- Managed PostgreSQL in AWS us-east-2, United States
- Object storage and evidence artifacts
- Netlify Blobs selected by this deployment. Region and immutable-retention controls are host-managed and are not asserted here; workflows requiring versioned S3 custody fail closed.
- Inference
- Organization-owned provider keys and model selection are available. Provider and deployment policies govern inference location.
- Application logs and telemetry
- Serverless logs and telemetry may be processed in provider-operated hosting regions; no contractual United States-only restriction is recorded
- Backups
- Managed backups in the same region as the primary database
| Question | Today, in production | Enterprise — designed, not built | Sovereign — designed, not built |
|---|---|---|---|
| Primary database | Managed PostgreSQL in AWS us-east-2, United States | A second project in eu-central-1, with per-organization home-region routing | A dedicated project in a customer-named region |
| Object storage and evidence artifacts | Netlify Blobs selected by this deployment. Region and immutable-retention controls are host-managed and are not asserted here; workflows requiring versioned S3 custody fail closed. | The customer bucket, in the customer region, under the customer keys | Customer bucket only; the control plane holds no artifacts |
| Inference | Organization-owned provider keys and model selection are available. Provider and deployment policies govern inference location. | Organization-specific inference residency guarantees are not available | An in-boundary model on the private runner; no external inference at all |
| Application logs and telemetry | Serverless logs and telemetry may be processed in provider-operated hosting regions; no contractual United States-only restriction is recorded | The same, with redaction attested | A customer-side log sink |
| Backups | Managed backups in the same region as the primary database | Same region as primary, with a stated retention period | Customer-controlled |
The two right-hand columns are grayed deliberately: they are specified and not built. No date is committed for either, and nothing in a contract should rely on them. The trust register lists the same absences with the date each was last reviewed.
Question 3, answered in code
Deployment model configuration
These values describe the platform default resolved when this page is served. They do not expose any organization’s private credential or model selection. Configuration does not verify provider availability; this page makes no provider request. Each actual run records its own inference boundary, account source and model.
| mode | inferenceBoundary | costBoundary | rawDataPolicy | What it means |
|---|---|---|---|---|
| managed-frontierselected by this deployment · configured, provider not checked | external-managed | variable-token | provider-policy | A managed frontier provider outside the customer boundary. Restricted payloads are denied to it unless the deployment explicitly opts in. |
| private-compliance | customer-controlled | customer-runtime | no-training | A model endpoint the customer controls, speaking the common chat-completions wire format, reached over HTTPS or loopback against an origin allowlist and a health probe. |
| deterministic-fixture | local-fixture | zero-token | not-sent | No model call at all. Deterministic fixture output, which is what an unconfigured live route falls back to rather than failing open. |
The gate in front of it
What this deployment permits to leave the boundary
Routing decides where a call goes. The egress gate decides whether a payload may leave at all, and it is deny-by-default for restricted evidence. The reason codes below are the ones the gate writes into the decision record, evaluated against this deployment and its current route at request time — including, if restricted egress has been opted into, the code that says so.
| dataSensitivity | allowed | reason | Leaves the boundary as restricted data |
|---|---|---|---|
| public | true | non-restricted-egress-permitted | no |
| internal | true | non-restricted-egress-permitted | no |
| restricted | false | restricted-egress-denied | no |
A blocked call raises a typed error rather than silently dropping, so the refusal itself is sealed as an auditable event. The opt-in is a deployment-wide flag today; making it a per-organization policy is specified and not built.
Consequences
What each answer means in a review
- The routing boundary is explicit
- ControlFrame records where inference runs, which contract governs it, and the configured raw-data policy so reviewers can inspect the decision.
- Organization-owned keys are available
- Organizations can select a supported provider credential and model. An unavailable saved choice, ambiguous credential set or missing model blocks that organization’s run; it never silently switches to a platform key.
- A customer-controlled endpoint is available
- The deployment can route to a customer-controlled model endpoint under the private-route policy. Selecting an organization-owned key does not by itself establish regional residency or permission to send restricted evidence.
- US only, said plainly
- The primary control-plane database is configured in AWS us-east-2. EU database residency is not available today, and no availability date is committed on this page. Hosting, object storage, email, and inference locations are stated separately because they do not share one residency boundary.
See who processes what · How tenants are isolated in one database · Back to the trust center