Data Residency
Table of contents Show Hide
Your data stays in the UK and EU
All customer data in GoSmarter is stored in the United Kingdom. A single processing step runs in the EU (Sweden). No customer data is stored or processed outside these regions.
Where your data lives
| What | Region | Purpose |
|---|---|---|
| Database | UK South | All business data — inventory, orders, users, companies |
| File storage | UK South | Uploaded documents including mill certificates |
| Messaging | UK South | Internal message routing between services |
| Secrets | UK South | Credentials and configuration secrets |
| Document classification | UK South | Identifies document type and supplier |
| Document extraction | Sweden Central (EU) | Extracts structured data from mill certificates |
| Frontend CDN | West Europe (EU) | Serves the web application (static files only — no customer data) |
About the EU processing step
Our document extraction service runs in Sweden Central, an EU region. This is because Azure Content Understanding, the AI service we use for structured data extraction, is not yet available in UK South.
What this means for your data:
- Document pages are sent to Sweden Central for processing, then results are returned and stored in UK South
- No customer data is persisted in Sweden: the service is stateless
- The transfer is encrypted in transit (TLS 1.2+) between Azure datacentres
- Sweden is within the UK GDPR adequacy framework, meaning UK data protection law recognises EU member states as providing adequate protection
Can I choose a different region?
No. GoSmarter is a single-region deployment. All customers’ persistent data is stored in UK South. We do not offer region selection or data migration to alternative regions.
US jurisdiction and the CLOUD Act
All GoSmarter data at rest is stored in Microsoft Azure datacentres in the UK and EU. Microsoft publishes transparency reports on government data requests and has committed to challenging requests that conflict with local data protection laws.
For additional detail on how Microsoft handles cross-border data requests, see:
- Microsoft EU Data Boundary: Microsoft’s commitment to storing and processing EU/UK customer data within the EU Data Boundary
- Microsoft Law Enforcement Requests Report
Backup and redundancy
Database backups and blob storage use locally redundant storage (LRS) within UK South. Data is replicated across multiple storage units within the same datacentre region. We do not currently offer geo-redundant backup or cross-region replication.
Key points for your security team
- Persistent data: UK South only (database, files, secrets, messaging)
- Transient processing: Sweden Central (EU) for document extraction: stateless, encrypted in transit
- Static assets: West Europe (EU): application code only, no customer data
- No US storage or processing: All data at rest is in UK/EU Azure regions
- Single-region deployment: No customer-selectable regions
- Encryption in transit: TLS 1.2 minimum enforced on all services
Request evidence
Need more detail for your compliance review? We can provide:
- Confirmation of Azure region deployment
- Details of data processing activities under GDPR
- Our Data Processing Agreement (DPA)