Drıftstack docs
Docs

Where data is stored; choosing a region

You might be here because: “Where is my data stored?” · “Can I pick which region my data is stored in?” · “Preferred data region” · “is my data in the EU” · “GDPR” · “does the region setting move my data” · “where do sessions run” · “who are your sub-processors” · “data residency” · “delete my data”

Short answer

Customer data in our databases — your account, profiles, audit logs, session metadata — is stored in the EU today. Two things are outside it: uploaded file objects, which can replicate outside the EU, and session execution, which runs in the US under standard contractual clauses and the EU-US Data Privacy Framework. The Preferred data region setting is a preference only and does not change where your data is stored.

Check first

  • Which data are you asking about — database records, uploaded files, or where a session’s browser runs? Each has a different answer.
  • For a contractual answer, the sub-processor register and the DPA on the Driftstack website list every provider with its region and transfer basis; they are the authoritative location contract.

Likely causes and fixes

  1. What is stored in the EU today. Accounts (two-factor secrets encrypted), API keys (hashes only), session metadata and events, profile metadata, the audit log, webhook configuration and delivery log, and cache entries; error monitoring also uses an EU region.

  2. What can leave the EU. File objects — avatars and stored profile state — live on a storage network that replicates across EU and US; if you need strict EU-only file storage, don’t store files you can’t accept that for. Files you add to a session are different: they stay on the Mac running the session, only for that session, and are deleted when it ends; they are never copied to that storage network. Session execution: profile state is loaded onto the machine running your session for its life, and session traffic passes through US infrastructure. The AI agent (US) engages its provider only when you use it. Each session’s screen is streamed from the start to Driftstack’s own video relay on the Mac running it (US); Driftstack does not record it, and support cannot join. Payment processors hold the payment data they process; we hold only linkage ids.

  3. “Preferred data region”: us, eu, apac or no preference. Set under Settings; it is informational only — every customer’s account data is stored in the EU today whatever you choose, and setting it neither routes execution nor moves stored data.

  4. Will it change? Any material change of location or sub-processor follows the DPA’s process (Section 3.4): when the change takes effect, the notice we give, and a right to object.

  5. Deleting your data. Deleting the account revokes access immediately — web sessions, API keys and webhooks stop — and stored data is purged within the DPA’s retention windows, with a 30-day outer bound; copies in encrypted backups are gone within a further 40 days. Data subject requests go to [email protected]; you get an acknowledgement with a reference and the date by which we answer (one month under the GDPR).

If it still fails

Privacy and legal questions are answered by a person, never by the assistant: press Talk to a person in this chat (or open Help), or email [email protected], and say what you need — a written confirmation of locations, a copy of the DPA, or a data subject request — with your account email.