Data residency

Where customer data lives, what crosses borders, and how to constrain it.

Default footprint

A free or paid (non-Enterprise) account’s data lives in:

  • Argentina (San Juan) — primary GoTrue Postgres, LiteLLM Postgres, object storage.
  • EU (Frankfurt) — DR mirror, 6h lag.
  • Stripe (US, EU) — billing only.

What crosses borders

  • Identity → only on DR mirror (encrypted, internal).
  • Inference content → does not leave the gateway’s region in production; we don’t echo to a logging sink outside the region.
  • Stripe billing data → outside our control, governed by Stripe’s International Data Transfers.

Enterprise residency pinning

Enterprise contracts can pin to:

  • AR only — disable EU DR; data lives in San Juan exclusively. RPO is degraded to “best-effort” since DR is off.
  • EU only — primary served from EU, DR in AR.
  • Single tenant on dedicated cluster — separate Postgres/LiteLLM/object storage instances in the customer’s preferred region.

See Enterprise: Custom deployment.

Sub-processor changes

We notify all customers ≥30 days before adding or removing a sub-processor that handles customer data. Enterprise customers can object to a sub-processor change; we’ll work with you on a remediation path.

Last updated: