Data residency
Last updated 7 October 2026. Source: sheptra.core/docs/decision_records/hosting.md §1, §7, §8, §9 · sheptra.infra/envs/staging/terraform.tfvars
Where customer data is stored and processed today, and what choosing a region will mean. The short version: one region, in the United States, with the region of a dedicated cell as the lever once dedicated cells exist.
One region today#
The estate is one cell in one DigitalOcean region, New York (nyc3). Everything the engine stores — your definitions, instances, history, incidents, jobs and tasks — and everything the modeler stores lives on managed Postgres servers in that region, with their backups. The archive the retention sweep writes to sits in Cloudflare R2 with an Eastern North America location hint. Identity and telemetry are SaaS providers in the United States.
| Data | Where | Note |
|---|---|---|
| Process definitions, running instances, execution history, incidents, jobs, user tasks | DigitalOcean Managed PostgreSQL — New York (nyc3), United States | The engine database of the cell your workspace runs on |
| Modeler content: diagrams, forms, decisions, versions, deployments; organization and member records | DigitalOcean Managed PostgreSQL — New York (nyc3), United States | The management database; one per estate, not per cell |
| Archived execution history and retired instances | Cloudflare R2 — Eastern North America | Written by the retention sweep; see retention and deletion |
| Identity: names, email addresses, organization membership, roles, worker credentials | WorkOS — United States | Sign-in, SSO and SCIM |
| Telemetry: logs, traces and metrics | Grafana Cloud — United States | Identifiers and timings, not process variables; one stack for the whole estate |
| Requests in transit to any host | Cloudflare’s global network | TLS is terminated at the point of presence nearest the caller and re-encrypted to the origin |
| Backups and point-in-time recovery | With the cluster — New York (nyc3), United States | Seven-day window, provider-managed |
| The notify list on this site | Cloudflare D1 — single location, no replication | See the privacy note |
Requests reach every host through Cloudflare’s network, which terminates TLS at the point of presence nearest the caller and carries the request to the origin encrypted. Request content is processed in transit there; it is not stored at the edge.
Choosing a region#
A dedicated cell — isolation rung 2 and up on the security overview — is provisioned in the DigitalOcean region the contract names, with its own Postgres server and backups in that region. That is the residency lever. It is not available yet: the module that builds a cell exists and runs the shared cell, and the first dedicated cell is being provisioned on staging to prove that a second one touches nothing shared. We will not offer a region before that proof exists.
Three things do not move with a cell, and a contract that names a region needs to say what happens to each:
- Modeler content and organization records stay on the management plane, which is one per estate, in the United States. A dedicated modeler database per organization is a planned add-on, not a property of a dedicated cell.
- Identity stays with WorkOS in the United States at every rung.
- Telemetry goes to one estate-wide stack in the United States. Logs and traces carry identifiers and timings rather than process variables, but a cell placed in a region for residency reasons still sends its operational signals elsewhere. Whether that is acceptable is a contractual question, and we treat a regional telemetry stack as part of the cost of a regional cell rather than assuming the answer.
Your own cloud account#
Rung 4 is a dedicated cell deployed into your own AWS account: the data plane, its region, its encryption key and its private endpoint are yours; deployment, upgrades and operations stay ours. It is the answer when the requirement is “our data never leaves our account” rather than “our data stays in this region”. It is built against a signed contract, not ahead of one, and it is not offered on DigitalOcean.
Transfers#
Sheptra, Inc. is a United States company and processes customer data in the United States. For customers who need a transfer mechanism, the data processing agreement draft incorporates the standard contractual clauses; the clauses and the governing law are with counsel. If your review needs a specific answer before that closes, ask.