Data Residency
Table of contents Show Hide
Your data stays in the UK and EU
All customer data in GoSmarter is stored in the United Kingdom. A single processing step runs in the EU (Sweden). No customer data is stored or processed outside these regions.
Where your data lives
| What | Region | Purpose |
|---|---|---|
| Database | UK South | All business data — inventory, orders, users, companies |
| File storage | UK South | Uploaded documents including mill certificates |
| Messaging | UK South | Internal message routing between services |
| Secrets | UK South | Credentials and configuration secrets |
| Document classification | UK South | Identifies document type and supplier |
| Document extraction | Sweden Central (EU) | Extracts structured data from mill certificates |
| Address geocoding | UK South | Suggests structured addresses and coordinates for companies/organisations |
| Frontend CDN | West Europe (EU) | Serves the web application (static files only — no customer data) |
About the EU processing step
Our document extraction service runs in Sweden Central, an EU region. This is because Azure Content Understanding, the AI service we use for structured data extraction, is not yet available in UK South.
What this means for your data:
- Document pages are sent to Sweden Central for processing, then results are returned and stored in UK South
- No customer data is persisted in Sweden: the service is stateless
- The transfer is encrypted in transit (TLS 1.2+) between Azure datacentres
- Sweden is within the UK GDPR adequacy framework, meaning UK data protection law recognises EU member states as providing adequate protection
About the address geocoding step
When you enter a company or organisation address, GoSmarter can call Azure Maps to suggest a structured address and geographic coordinates (used for supplier/customer management and, in later releases, transport-distance and emissions reporting).
- Azure Maps uses a single global API endpoint rather than a per-region one, but the Azure Maps account behind it is configured for the UK South region, and Microsoft’s documented default behaviour is to process and store requests within the account’s configured region
- Azure Maps does not offer a UK-specific data-residency guarantee at the API level (only broader “Europe” and “United States” geographic-scope options exist, and “Europe” in this context means Ireland/Netherlands datacentres, not the UK) — our region-pinned account configuration is what keeps this processing in the UK, not an endpoint-level enforcement
- No customer data is persisted by Azure Maps: address queries are used to return suggestions and are not stored by the service
- Authentication uses managed identity — no API keys are stored in application code or configuration
Can I choose a different region?
No. GoSmarter is a single-region deployment. All customers’ persistent data is stored in UK South. We do not offer region selection or data migration to alternative regions.
US jurisdiction and the CLOUD Act
All GoSmarter data at rest is stored in Microsoft Azure datacentres in the UK and EU. Microsoft publishes transparency reports on government data requests and has committed to challenging requests that conflict with local data protection laws.
For additional detail on how Microsoft handles cross-border data requests, see:
- Microsoft EU Data Boundary: Microsoft’s commitment to storing and processing EU/UK customer data within the EU Data Boundary
- Microsoft Law Enforcement Requests Report
Backup and redundancy
Database backups and blob storage use locally redundant storage (LRS) within UK South. Data is replicated across multiple storage units within the same datacentre region. We do not currently offer geo-redundant backup or cross-region replication.
Key points for your security team
- Persistent data: UK South only (database, files, secrets, messaging)
- Transient processing: Sweden Central (EU) for document extraction: stateless, encrypted in transit
- Address geocoding: Azure Maps, region-pinned to UK South at the account level; global API endpoint, no data persisted by the service
- Static assets: West Europe (EU): application code only, no customer data
- No US storage or processing: All data at rest is in UK/EU Azure regions
- Single-region deployment: No customer-selectable regions
- Encryption in transit: TLS 1.2 minimum enforced on all services
Request evidence
Need more detail for your compliance review? We can provide:
- Confirmation of Azure region deployment
- Details of data processing activities under GDPR
- Our Data Processing Agreement (DPA)