Data Residency
Last updated: 24 April 2026
CrowAgent operates from the United Kingdom and processes personal data primarily in Europe. This page discloses the specific regions where each class of data is stored and processed, so you can make an informed procurement decision.
1. Primary storage and processing
| Service | Purpose | Region |
|---|---|---|
| Supabase (Postgres + Auth + Storage) | Primary database, authentication, report PDFs | AWS eu-west-1 (Ireland) |
| Railway (FastAPI compute) | Backend API, EPC lookups, PDF generation | europe-west4 (Amsterdam) |
| Vercel (Next.js) | Frontend hosting, edge functions | Global edge; compute region lhr1 (London) |
| Cloudflare (DNS, DDoS, WAF) | Edge security and DNS resolution | Global edge; no persistent storage |
2. Third-party sub-processor regions
| Sub-processor | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe, Ltd | Billing, VAT handling, card vaulting | EU (Dublin) with limited US fallback | SCCs + EU-US DPF |
| Resend (via Amazon SES) | Transactional email | eu-west-1 (Ireland) | SCCs |
| Sentry GmbH | Error telemetry (scrubbed) | EU region | SCCs |
| PostHog | Product analytics (consented) | eu.posthog.com (Frankfurt) | SCCs |
| Google Gemini (via Vertex AI) | Social Value narrative generation | europe-west4 (Amsterdam) | SCCs + UK IDTA |
| Upstash Redis | Rate limiting counters (no PII) | eu-west-1 (Ireland) | SCCs |
3. International transfers
Where a sub-processor operates outside the UK/EEA, we rely on the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs) plus any additional safeguards required by the relevant supervisory authority. A full list of transfer mechanisms is maintained in our Data Processing Agreement.
4. Region-pinning for enterprise customers
We do not currently offer region-pinning beyond the EU region shown above. Customers with a regulatory requirement to store data exclusively in the UK (rather than the EEA) should contact hello@crowagent.ai to discuss the Enterprise plan; we can route Supabase Storage to eu-west-2 (London) on an individual contract basis.
5. Changes to residency
Any change that would move your data into a different region will be disclosed here and emailed to account holders at least 30 days in advance.