Data residency
Where each kind of data lives, including the parts that leave the EU. Clause 2 is the one to read if you are checking whether we can take your data.
[LEGAL ENTITY] · In effect from [DATE]
This is a draft and is not in force. It still has placeholders in it (entity, address, registration, email, privacyEmail, effective), and it has not been reviewed by a lawyer. Fill them in at lib/legal.ts and have every document here read before anyone is charged.
1.The short answer
Your workspace is stored in the EU, and the software that works on it runs in the EU. Three things leave it: what your agents send to the model you chose, your sign-in details, and payments. Each is listed below with the reason.
2.Where each kind of data lives
In the EU
| What | Where | How we know |
|---|---|---|
| Your workspace: agents, skills, conversations, documents, schedules | Frankfurt, Germany | Our database provider's region, eu-central-1 |
| The application, and the runtime that runs your agents | Frankfurt, Germany | Every request reports it was served from Frankfurt |
| The isolated environments agents work in | Paris, France | The region our sandbox provider is configured to use |
Outside the EU
| What | Where | How we know |
|---|---|---|
| What an agent is asked, and what it reads while working | Any region the model provider serves from, including the United States | Our model gateway routes globally unless a region is pinned, and none is |
| Your name, email address and sign-in | United States | Held by Clerk |
| Payment details | United States and Ireland | Held by Stripe; card numbers never reach us |
3.The model is the part that matters
An agent works by sending its task, and whatever it reads while working, to a language model. That content goes to the model provider, and by default the provider may process it in any region it serves from, including the United States.
It can be pinned. Our model gateway supports restricting inference to EU data centres, and when it is pinned the provider also stores anything it keeps in the EU, and a request it cannot serve there fails rather than quietly running elsewhere. It is not switched on today because not every model is available in the EU, and pinning would stop agents on those models working at all. If you need it, ask, and we will tell you which models it covers.
Two things are outside anybody’s control here, and it would be dishonest to leave them out. A provider may retain a request it flags for abuse review under its own policies, wherever that happens. And a request can reach the gateway through any of its data centres before being forwarded, even when inference is pinned.
4.How we know
Every row in clause 2 was checked against the running system rather than taken from a configuration file, and each one says how. That matters more than it sounds: our hosting project’s default region is in the United States, and the application only runs in Frankfurt because the deployment overrides it. A statement written from the setting would have been wrong about the whole application.
5.Related
The privacy policy says what we hold and why, and the data processing agreement names every sub-processor and the safeguards for transfers outside the EU.