Pick the region once
Residency is decided at the start of the engagement and then enforced by the platform rather than remembered by people. Moving between regions is a migration, deliberately, because a boundary you can casually cross is not one.
- Regions3
- Encryption at restAES-256
- Default retention13 months
Dublin
Ireland
- Supervisory authority
- Data Protection Commission
- Usually chosen by
- Operators licensed in the EEA and the UK
The default for European traffic and the region our own company records sit in.
Frankfurt
Germany
- Supervisory authority
- Hessian data protection authority
- Usually chosen by
- Groups with a German or Austrian licence condition
Chosen where a licence condition names a specific member state for processing.
Toronto
Canada
- Supervisory authority
- Office of the Privacy Commissioner
- Usually chosen by
- Provincially licensed operators in Canada
Keeps Ontario traffic inside the country, which several provincial agreements require.
What stays in region
- Message bodies, as submitted and as delivered
- Recipient numbers, and every consent record attached to them
- Delivery receipts, rejection reasons and inbound replies
- Account audit trails, including who read what and when
- Backups and their restore path, which never leave the region either
What necessarily crosses a border
A message to a Peruvian handset has to reach a Peruvian network, so being straight about the exceptions matters more than an absolute claim nobody could keep.
- The destination number and the message body, handed to the network that serves it
- Aggregate counts with no personal data, used for capacity planning and invoicing
- Nothing else: no consent history, no evidence references, no account records
How the boundary is actually held
Enforced in the storage layer
Region is a property of the account, resolved before any write. There is no code path that stores a message outside the region on its record, which is why a change is a migration rather than a setting.
Support tooling obeys it too
The internal console reads from the same region-scoped store. An engineer in the wrong region does not get a redacted view, they get no view, and the attempt is written to the audit trail.
Retention with a documented floor
Thirteen months by default, adjustable to your schedule, with a floor for records that law requires us to keep. Deletion runs on a job you can see the last run of.
Send us the residency clause
If a licence condition or a group policy names a country, quote it to us and we will tell you plainly whether we can meet it before anything is signed.