Drıftstack docs
Docs

Data residency

This page covers where your data physically lives, what counts as customer data for residency purposes, and what the region account preference does. The one-line version: customer data in our databases is stored in the EU today; file objects can replicate outside the EU and session execution runs in the US, and the transfers that do happen are covered by the EU-US Data Privacy Framework (DPF) where the provider is certified under it, and otherwise by the EU’s standard contractual clauses (SCCs).

The short answer

  • The API servers and databases run in the EU (Hetzner in Germany for compute and the cache, Neon in Frankfurt for Postgres). Customer data in our databases — your account, profiles, audit logs, session metadata — is stored in the EU today.
  • File objects (your avatar and saved profile state) use Cloudflare’s R2 storage network in its default jurisdiction, which replicates across EU + US regions. There is no EU-only storage guarantee for file objects.
  • Files you add to a session (uploads) are not file objects: they stay in that session’s own folder on the Mac running it, only for the session, and are deleted when it ends. They are never copied to R2 and never saved with a profile. (Downloads from pages are not available yet.)
  • Session execution — your iPhone Safari sessions run on MacStadium hardware in the US, under SCCs + the EU-US DPF.
  • The complete sub-processor list, with each provider’s region and contractual transfer basis, is published at driftstack.io/trust/sub-processors and in the DPA.

What lives where

Data Where Notes
Account row (email, tier, slug, region preference) Postgres (Neon, Frankfurt) MFA secrets are stored encrypted.
API keys Postgres (Neon, Frankfurt) Stored as hashes; the plaintext key is never stored.
Session metadata + event timeline Postgres (Neon, Frankfurt) Lifecycle rows and events.
Profile metadata (name, device, description) Postgres (Neon, Frankfurt)
Audit log Postgres (Neon, Frankfurt) Append-only.
Webhook endpoints + delivery log Postgres (Neon, Frankfurt)
Encrypted database backups Amazon S3 (Frankfurt) Encrypted before upload; each copy kept up to 40 days
File objects (avatars, stored profile state) Cloudflare R2 Default jurisdiction; replicates across EU + US. Access is via short-lived presigned URLs.
Files added to a session (uploads) The Mac running the session (MacStadium, US) That session’s own folder, for the session only; deleted when it ends. Never on R2.
Desktop app recordings Your own computer Made and saved by the desktop app; never uploaded.
Cache (auth cache, rate-limit counters, MFA challenges) Redis on our own API server (Hetzner, Germany) Short-lived entries.
Error monitoring Sentry, EU ingest region ingest.de.sentry.io.
Transactional email Postmark (US) Recipient address + template payload; SCCs + DPF cover the provider.
Card billing Stripe (Payments Europe, IE; Stripe, LLC, US) We never see card numbers. Stripe, LLC gets every customer’s payment data: DPF, else SCCs.
Session execution (browsers) MacStadium (US) SCCs + EU-US DPF.
Optional AI agent (bundled or BYOK) Anthropic (US) Only when the AI feature is actually used in a session; SCCs.
Live video (live view) Driftstack’s own relay (on the session’s Mac, US) Streamed from the start. Driftstack does not record it, and support cannot join.

What is stored in the EU today

Database content: accounts, profile metadata, session metadata, audit logs, webhook configuration and delivery records — on Neon (Frankfurt) — and cache content on our own API server (Hetzner, Germany). These are stored in the EU today. We do not promise that this never changes; a change follows the DPA’s notice process.

What can leave the EU

  • File objects on R2 — your avatar and saved profile state. Cloudflare’s storage network can replicate outside the EU. If your threat model requires strict EU-only file storage, don’t store files you can’t accept that for, and talk to us about your requirements before relying on anything stronger.
  • Session execution — profile state, and any file you add to the session, is on the machine running your session for the life of that session (added files are deleted when it ends), and session traffic between the API, your session’s browser, and your target site passes through MacStadium infrastructure in the US. Contractual basis: SCCs + EU-US DPF.
  • Optional features — the AI agent (Anthropic, US) engages its provider only when you actually use it.
  • Live view — each session’s screen is streamed from the start to Driftstack’s own video relay on the same serving machine (US), so you and your team’s admins can watch it live. Driftstack does not record it, and Driftstack support cannot join. When a viewer opens the live view, the viewer’s browser contacts public address-lookup (STUN) servers run by Google and Twilio to learn its own network address. Those servers see the viewer’s IP address and nothing else; no session data or media passes through them.
  • Payment processors — Stripe holds the payment data it processes under its own compliance regime; we hold only the linkage ids. Crypto payments are made on our crypto payment processor’s own payment page.

The region account preference

You can record a region preference (us, eu, or apac, or none) on your account — from Settings → Region in the Driftstack dashboard.

For v1 the preference is informational only: every customer’s account data is stored in the EU today regardless of the value. Setting it does not route execution or move stored data. The locations in the table above, the published sub-processor register, and the DPA are the authoritative physical-location contract. Any material location or sub-processor change follows the DPA’s Article 28 process (Section 3.4): when the change takes effect, the notice we give, and the documented objection rights.

Deletion + data subject requests

Deleting your account revokes access immediately — web sessions, API keys, and webhook endpoints stop working at deletion time — and stored data is purged within the retention windows disclosed in the DPA (the retention table discloses a 30-day outer bound for post-termination deletion; copies in encrypted backups are gone within a further 40 days). References held by payment processors are governed by their own retention policies.

Data subject access requests (GDPR): [email protected].