Drıftstack docs
Docs

Where data is stored; choosing a region

You might be here because: “Where is my data stored?” · “Can I pick which region my data is stored in?” · “Preferred data region” · “is my data in the EU” · “GDPR” · “does the region setting move my data” · “where do sessions run” · “who are your sub-processors” · “data residency” · “delete my data”

Short answer

Customer data in our databases — your account, profiles, audit logs, session metadata — is stored in the EU today. Two things can be outside it: file objects — avatars, stored profile state and the archive of session events older than 90 days — which can replicate outside the EU, and session execution: sessions run on Macs in the US or the Netherlands, the US ones under standard contractual clauses and the EU-US Data Privacy Framework. The Preferred data region setting is a preference only and does not change where your data is stored.

Check first

  • Which data are you asking about — database records, uploaded files, or where a session’s browser runs? Each has a different answer.
  • For a contractual answer, the sub-processor register and the DPA on the Driftstack website list every provider with its region and transfer basis; they are the authoritative location contract.

Likely causes and fixes

  1. What is stored in the EU today. Accounts (two-factor secrets encrypted), API keys (hashes only), session metadata and the last 90 days of session events, profile metadata, the audit log, webhook configuration and delivery log, and cache entries; error monitoring also uses an EU region.

  2. What can leave the EU. File objects — avatars, stored profile state and the archive of session events older than 90 days — use Cloudflare’s storage: avatars live on a storage network that replicates across EU and US; stored profile state and the archive are stored by Cloudflare in Western Europe, not guaranteed to stay in the EU; if you need strict EU-only file storage, don’t store files you can’t accept that for; this does not cover the archive of session events, which is made for every session. Files you add to a session are different: they stay on the Mac running the session, only for that session, and are deleted when it ends; they are never copied to Cloudflare’s storage. Session execution: profile state is loaded onto the machine running your session for its life, and session traffic passes through that Mac’s host, in the US or the Netherlands. The AI agent (US) engages its provider only when you use it. Each session’s screen is streamed from the start to Driftstack’s own video relay on the Mac running it (US or the Netherlands); Driftstack does not record it, and support cannot join. Payment processors hold the payment data they process; we hold only linkage ids.

  3. “Preferred data region”: us, eu, apac or no preference. Set under Settings; it does not move stored data — every customer’s account data is stored in the EU today whatever you choose. You cannot choose the country your session runs in; we pick the Mac. Your preferred data region makes that region our first choice, but it is not a guarantee.

  4. Will it change? Any material change of location or sub-processor follows the DPA’s process (Section 3.4): when the change takes effect, the notice we give, and a right to object.

  5. Deleting your data. Deleting the account revokes access immediately — web sessions, API keys and webhooks stop. When you delete your account, we delete your account data within 30 days; copies in encrypted backups are gone within a further 40 days. Short records of your past browser sessions are not deleted with the account: they stay in our database for 90 days and are then moved to an archive. Automatic deletion of that archive is not switched on yet; until it is, archived records are not deleted automatically. Data subject requests go to privacy@driftstack.dev; you get an acknowledgement with a reference and the date by which we answer (one month under the GDPR).

If it still fails

Privacy and legal questions are answered by a person, never by the assistant: press Talk to a person in this chat (or open Help), or email privacy@driftstack.dev, and say what you need — a written confirmation of locations, a copy of the DPA, or a data subject request — with your account email.