Drıftstack docs
Docs

Data residency

This page covers where your data physically lives, what counts as customer data for residency purposes, and what the region account preference does. The one-line version: customer data in our databases is stored in the EU today; file objects can replicate outside the EU, and sessions run on Macs in the US or the Netherlands, and the transfers that do happen are covered by the EU-US Data Privacy Framework (DPF) where the provider is certified under it, and otherwise by the EU’s standard contractual clauses (SCCs).

The short answer

  • The API servers and databases run in the EU (Hetzner in Germany for compute and the cache, Neon in Frankfurt for Postgres). Customer data in our databases — your account, profiles, audit logs, session metadata — is stored in the EU today.
  • File objects (your avatar, saved profile state, and the archive of session events older than 90 days) use Cloudflare’s R2 storage network. Your avatar is in its default jurisdiction, which replicates across EU + US regions. Saved profile state and the archive are in R2’s default jurisdiction, in the location Cloudflare calls Western Europe (WEUR), which does not guarantee that the data stays in the EU. There is no EU-only storage guarantee for file objects.
  • Files you add to a session (uploads) are not file objects: they stay in that session’s own folder on the Mac running it, only for the session, and are deleted when it ends. They are never copied to R2 and never saved with a profile. (Downloads from pages are not available yet.)
  • Session execution — your iPhone Safari sessions run on Macs in the US or the Netherlands: in the US on MacStadium hardware, under SCCs + the EU-US DPF; in the Netherlands on a Mac hosted by Green Mini host B.V., in the EU. You cannot choose the country your session runs in; we pick the Mac.
  • The complete sub-processor list, with each provider’s region and contractual transfer basis, is published at driftstack.io/trust/sub-processors and in the DPA.

What lives where

Data Where Notes
Account row (email, tier, slug, region preference) Postgres (Neon, Frankfurt) MFA secrets are stored encrypted.
API keys Postgres (Neon, Frankfurt) Stored as hashes; the plaintext key is never stored.
Session metadata + event timeline Postgres (Neon, Frankfurt) Lifecycle rows and events. Events older than 90 days move to the session archive (next row).
Session archive (events older than 90 days) Cloudflare R2 Default jurisdiction, in the location Cloudflare calls Western Europe (WEUR), which does not guarantee that the data stays in the EU. Encrypted at rest by Cloudflare.
Profile metadata (name, device, description) Postgres (Neon, Frankfurt)
Audit log Postgres (Neon, Frankfurt) Append-only.
Webhook endpoints + delivery log Postgres (Neon, Frankfurt)
Encrypted database backups Amazon S3 (Frankfurt) Encrypted before upload; each copy kept up to 40 days
File objects (avatars) Cloudflare R2 Default jurisdiction; replicates across EU + US. Access is via short-lived presigned URLs.
File objects (stored profile state) Cloudflare R2 Default jurisdiction, in the location Cloudflare calls Western Europe (WEUR), which does not guarantee that the data stays in the EU. Access is via short-lived presigned URLs.
Files added to a session (uploads) The Mac running the session (US or the Netherlands) That session’s own folder, for the session only; deleted when it ends. Never on R2.
Desktop app recordings Your own computer Made and saved by the desktop app; never uploaded.
Cache (auth cache, rate-limit counters, MFA challenges) Redis on our own API server (Hetzner, Germany) Short-lived entries.
Error monitoring Sentry, EU ingest region ingest.de.sentry.io.
Transactional email Postmark (US) Recipient address + template payload; SCCs + DPF cover the provider.
Card billing Stripe (Payments Europe, IE; Stripe, LLC, US) We never see card numbers. Stripe, LLC gets every customer’s payment data: DPF, else SCCs.
Session execution (browsers) MacStadium (US) or Green Mini host B.V. (Netherlands) US: SCCs + EU-US DPF. Netherlands: host in the EU, no transfer to it.
Optional AI agent (bundled or BYOK) Anthropic (US) Only when the AI feature is actually used in a session; SCCs.
Live video (live view) Driftstack’s own relay (on the session’s Mac, US or the Netherlands) Streamed from the start. Driftstack does not record it, and support cannot join.

What is stored in the EU today

Database content: accounts, profile metadata, session metadata, audit logs, webhook configuration and delivery records — on Neon (Frankfurt) — and cache content on our own API server (Hetzner, Germany). These are stored in the EU today. We do not promise that this never changes; a change follows the DPA’s notice process.

What can leave the EU

  • File objects on R2 — your avatar, saved profile state, and the archive of session events older than 90 days. Cloudflare’s storage network can replicate outside the EU. If your threat model requires strict EU-only file storage, don’t store files you can’t accept that for, and talk to us about your requirements before relying on anything stronger. This does not cover the archive of session events, which is made for every session.
  • Session execution — sessions run on Macs in the US or the Netherlands. Profile state, and any file you add to the session, is on the machine running your session for the life of that session (added files are deleted when it ends), and session traffic between the API, your session’s browser, and your target site passes through that Mac’s host: MacStadium in the US or Green Mini host B.V. in the Netherlands. Contractual basis for the US Macs: SCCs + EU-US DPF; the Netherlands Mac is in the EU, so no transfer is needed to it. Both hosts are listed in the sub-processor register and in section 7 of the Privacy policy.
  • Optional features — the AI agent (Anthropic, US) engages its provider only when you actually use it.
  • Live view — each session’s screen is streamed from the start to Driftstack’s own video relay on the same serving machine (US or the Netherlands), so you and your team’s admins can watch it live. Driftstack does not record it, and Driftstack support cannot join. When a viewer opens the live view, the viewer’s browser contacts public address-lookup (STUN) servers run by Google and Twilio to learn its own network address. Those servers see the viewer’s IP address and nothing else; no session data or media passes through them.
  • Payment processors — Stripe holds the payment data it processes under its own compliance regime; we hold only the linkage ids. Crypto payments are made on our crypto payment processor’s own payment page.

The region account preference

You can record a region preference (us, eu, or apac, or none) on your account — from Settings → Region in the Driftstack dashboard.

The preference does not move stored data: every customer’s account data is stored in the EU today regardless of the value. You cannot choose the country your session runs in; we pick the Mac. Your preferred data region makes that region our first choice, but it is not a guarantee. The locations in the table above, the published sub-processor register, and the DPA are the authoritative physical-location contract. Any material location or sub-processor change follows the DPA’s Article 28 process (Section 3.4): when the change takes effect, the notice we give, and the documented objection rights.

Deletion + data subject requests

Deleting your account revokes access immediately — web sessions, API keys, and webhook endpoints stop working at deletion time. When you delete your account, we delete your account data within 30 days; copies in encrypted backups are gone within a further 40 days. Short records of your past browser sessions are not deleted with the account: they stay in our database for 90 days and are then moved to an archive. Automatic deletion of that archive is not switched on yet; until it is, archived records are not deleted automatically. References held by payment processors are governed by their own retention policies.

Data subject access requests (GDPR): privacy@driftstack.dev.