Network & residency
Where your data is processed is a setting, not a hope.
Your workspace pins a jurisdiction. That pin rides every call — standard runs included — and several parts of this system would rather stop than run somewhere the pin does not cover. Those refusals are quoted below, verbatim from the code.
Workspace region
- CHPlaceable
- EUPlaceable
- UKPlaceable
- USPlaceable
- WORLDNot placeable
CH is the default for a new workspace. Change it in Settings → Security & Data.
Where compute runs
Three places, and what each one is allowed to hold.
“The cloud” is not an answer to a residency question. These are the three systems your data can touch, what each holds, and which agreement covers it.
Edge — the API and the dashboard
Everything you call runs as a Cloudflare Worker at the edge. Parsed uploads live in Cloudflare KV under a native TTL taken from your workspace retention setting — expiry is the storage layer’s job, not a cleanup task that can quietly stop running.
ResidencyGlobal PoPs, with per-customer region selection available on Cloudflare Enterprise — the plan on which the BAA is offered. See /legal/subprocessors §2.
State — the account database
Authentication, sessions, the wallet, the rate-limit ledger, the audit log and upload metadata sit in Supabase Postgres. In schema-only mode the stored sample is clamped to ≤3 rows of ≤80 characters and the full row set is null.
ResidencyUS or EU per project; Ireland for EU workloads, as named in DPA Article 8. HIPAA eligibility requires the Supabase HIPAA add-on on the operating organisation.
Compute — models and the program sandbox
Layer-5 AI cleanup and the reshape program sandbox both run through phi-cloud. A PHI call carries X-PHI and X-Region so the gateway is forced to pick a PHI-eligible model physically inside the jurisdiction you pinned.
ResidencyThe region is the placement decision; X-PHI is only the catalogue decision. Both are sent — see /routing for how they are resolved.
Macros are read, never run
We parse the VBA project out of a workbook and report what it contains — modules, entry points, risky-call signals — but nothing in this system executes it. There is no Excel host, so there is no residency question to answer about one. Macro EDITING is delegated to monopea and travels with the same region and data-class headers as every other model call.
How · lib/vba.ts implements the three stacked container formats by hand and is fail-soft throughout: a container we cannot parse is still reported as macro-bearing, never as clean.
- CH · EU · UK · US placement
- X-Region on every PHI call
- Sandbox refuses region-less runs
- BAA host allowlist fails closed
- Upload retention is yours to set
The region pin
One setting decides where compute may run.
PHI and standard are a separate axis: X-PHI picks which model catalogue is eligible, the region picks the ground the work is allowed to stand on. Both are sent. Zeroing the region on a standard run once broke every standard code-strategy reshape, which is exactly how load-bearing it is.
| Region | What it means | Sandbox placement |
|---|---|---|
| CHSwiss-resident inference under nFADP. This is the default region for a new workspace. | The default for a new workspace | Placeable |
| EUSupabase runs in Ireland for EU workloads (DPA Art. 8). GDPR with SCCs in the DPA. | EU-resident processing | Placeable |
| UKCovered by the same DPA under UK GDPR / DPA 2018. | UK-resident processing | Placeable |
| USThe region the general (non-PHI) model ladder pins itself to, because those model rows serve US. | US-resident processing | Placeable |
| WORLDThe program sandbox refuses a run with this setting rather than choosing a jurisdiction for you. | No pin | Not placeable |
Fail-closed
Three places this system stops instead of guessing.
Fail-open is the default failure mode of most infrastructure, and it is the wrong one for regulated data. Each of these paths refuses, names the variable that would have permitted it, and returns a message you can put in a ticket — the text under each card is the string the code actually emits.
No jurisdiction, no run
The reshape program sandbox will not execute against a workspace whose region is unset or WORLD. It stops with an error naming the jurisdictions it will accept, rather than defaulting to whichever one is nearest.
Verbatim“sandbox requires a jurisdiction with a compliant placement (one of CH, EU, UK, US); workspace region is unset” — sandboxPreflight() in lib/reshape/sandbox.ts.
No allowlisted host, no PHI
Full-data traffic is only permitted to leave for a hostname explicitly listed as BAA-covered. In production, an unset allowlist does not mean “allow everything” — it means full-data routing refuses outright.
Verbatim“phi_host_not_baa_covered: MAPR_PHI_ALLOWED_HOSTS unset in production — full-data PHI requests cannot be routed without an explicit BAA-host allowlist” — lib/llm.ts. /api/health reports the same component as down.
No tenant key, no sandbox
The sandbox refuses to execute on the platform’s own phi-cloud account. Every workspace gets its own sub-key, so consumption and cost attribute to the tenant that caused them and nothing is pooled.
Verbatim“sandbox requires a per-tenant phi-cloud key; refusing to bill the platform account” — sandboxPreflight() in lib/reshape/sandbox.ts.
How long it stays
Retention is a setting, and 24 hours is only its default.
A residency answer is half an answer without a clock. Parsed uploads expire on Cloudflare KV’s own native TTL, and the number that TTL is built from is yours.
| retention_hours | Uploads survive |
|---|---|
| 0Delete on commit. The entry is never written to KV at all — its TTL is already in the past, so the write is skipped — and it lives only in the per-isolate memory copy serving the in-flight request, which the commit handler then deletes. | Nothing survives the request |
| 24The default for a new workspace, and the value you get if the settings row cannot be read. | 24 hours |
| 168For an import you finish over a working week. | 7 days |
| 720The longest window the setting offers. | 30 days |
Retention governs the parsed upload — the transient copy the cascade works from. What the account itself holds, for how long, and who is allowed to read it back is a longer list: what we store and for how long.
Pin a jurisdiction, and the pin travels.
Set the region once in Settings → Security & Data. Every run carries it, and the parts that cannot honour it stop rather than improvise.