Data residency
Last updated 30 August 2026
ConformOps does not currently promise EU-only data residency or processing.
The verified production storage placement is European for D1 and R2, but the resources have no EU jurisdiction restriction and other processing paths remain global.
Verified production placement
A read-only infrastructure check on 29 August 2026 reported the production D1 primary in Cloudflare's Eastern Europe region with read replication disabled and no jurisdiction set. The production R2 bucket also reported Eastern Europe placement and uses the default jurisdiction. These are current placement facts, not contractual EU-only restrictions. Cloudflare location hints and automatic placement are not the same as an EU jurisdiction guarantee.
Cloudflare processing boundary
The web application runs on Cloudflare Workers. The repository does not configure Regional Services or an EU Customer Metadata Boundary, and Worker code can execute on Cloudflare's global network. Vectorize stores deterministic vectors of redacted evidence and Workflows executes assessment phases, but the checked-in configuration contains no regional restriction for either service. ConformOps therefore does not infer an EU-only boundary from the D1 and R2 placement.
Other providers
- PostHog is configured to use the EU ingestion host. That host choice does not prove that every PostHog account, support, or transfer path stays in the EEA.
- OpenAI uses the standard API endpoint, not the EU regional endpoint, and is called only when an Owner or Admin enables both the workspace and product settings.
- Resend, GitHub, Google, Microsoft, Stripe, and OSV may process data in the locations described by their applicable terms and service configuration.
International transfers
Where a transfer of personal data outside the EEA requires a GDPR transfer mechanism, the applicable adequacy decision or Article 46 safeguard for the provider and service must be used. Customers can request the transfer information relevant to their service path through the contact in the Privacy notice or review the Data processing agreement.
Customers with a strict residency requirement
Do not rely on ConformOps as an EU-only service under the current deployment. Meeting that requirement would need separately provisioned jurisdiction-restricted D1 and R2 resources, regional request processing and metadata controls, confirmed regional behavior for Vectorize and Workflows, and EU or disabled routes for every optional processor. None of those future steps is represented as already complete.