Data Residency

Your data, region by region

Core platform data hosted directly by GoSmarter is stored in the United Kingdom, with a single stateless processing step in the EU (Sweden). Two third-party sub-processors — Clerk (identity/authentication) and Stripe (billing) — transfer data to the United States under recognised international transfer mechanisms rather than hosting it in the UK/EU; see “Third-party sub-processor regions” below for what this means in practice.

Where your data lives

Third-party sub-processor regions (Clerk, Stripe)

GoSmarter’s identity provider (Clerk) and billing provider (Stripe) are third-party sub-processors that process a limited set of personal/business data on our behalf (see Privacy & Data Protection for the full sub-processor list). Neither offers UK/EU data residency; both process and store data in the United States and rely on recognised international transfer mechanisms for GDPR-lawful transfer:

• Clerk: stores user identity data (name, email, session/authentication metadata) and organisation/company membership metadata. Clerk’s infrastructure runs on Google Cloud and Cloudflare, hosted in the United States — no EU/UK residency option is offered at any tier. International transfer relies on Clerk’s self-certification under the EU-US, UK-US, and Swiss-US Data Privacy Framework (see Clerk’s DPA).
• Stripe: processes subscription and payment data. GoSmarter does not store card details directly — Stripe’s own hosted checkout/billing portal collects and stores payment instruments. Stripe, LLC processes and stores this data in the United States; international transfer relies on Standard Contractual Clauses and the Data Privacy Framework (see Stripe’s DPA).

About the EU processing step

Our document extraction service runs in Sweden Central, an EU region. This is because Azure Content Understanding, the AI service we use for structured data extraction, is not yet available in UK South.

What this means for your data:

• Document pages are sent to Sweden Central for processing, then results are returned and stored in UK South
• No customer data is persisted in Sweden: the service is stateless
• The transfer is encrypted in transit (TLS 1.2+) between Azure datacentres
• Sweden is within the UK GDPR adequacy framework, meaning UK data protection law recognises EU member states as providing adequate protection

About the address geocoding step

When you enter a company or organisation address, GoSmarter can call Azure Maps to suggest a structured address and geographic coordinates (used for supplier/customer management and, in later releases, transport-distance and emissions reporting).

• Azure Maps uses a single global API endpoint rather than a per-region one, but the Azure Maps account behind it is configured for the UK South region, and Microsoft’s documented default behaviour is to process and store requests within the account’s configured region
• Azure Maps does not offer a UK-specific data-residency guarantee at the API level (only broader “Europe” and “United States” geographic-scope options exist, and “Europe” in this context means Ireland/Netherlands datacentres, not the UK) — our region-pinned account configuration is what keeps this processing in the UK, not an endpoint-level enforcement
• No customer data is persisted by Azure Maps: address queries are used to return suggestions and are not stored by the service
• Authentication uses managed identity — no API keys are stored in application code or configuration

Can I choose a different region?

No. GoSmarter is a single-region deployment. All customers’ persistent data is stored in UK South. We do not offer region selection or data migration to alternative regions.

US jurisdiction and the CLOUD Act

All GoSmarter-hosted data at rest (see “Where your data lives” above) is stored in Microsoft Azure datacentres in the UK and EU. Microsoft publishes transparency reports on government data requests and has committed to challenging requests that conflict with local data protection laws.

This section covers our own Azure infrastructure only. Clerk and Stripe are both US-headquartered and process data in the United States — see “Third-party sub-processor regions” above for their jurisdictional posture and transfer mechanisms.

For additional detail on how Microsoft handles cross-border data requests, see:

• Microsoft EU Data Boundary: Microsoft’s commitment to storing and processing EU/UK customer data within the EU Data Boundary
• Microsoft Law Enforcement Requests Report

Backup and redundancy

Database backups and blob storage use locally redundant storage (LRS) within UK South. Data is replicated across multiple storage units within the same datacentre region. We do not currently offer geo-redundant backup or cross-region replication.

Key points for your security team

• Persistent data (GoSmarter-hosted): UK South only (database, files, secrets, messaging)
• Transient processing: Sweden Central (EU) for document extraction: stateless, encrypted in transit
• Address geocoding: Azure Maps, region-pinned to UK South at the account level; global API endpoint, no data persisted by the service
• Static assets: West Europe (EU): application code only, no customer data
• Identity & billing (third-party): Clerk and Stripe — both process and store data in the United States under DPF/SCC transfer mechanisms, see “Third-party sub-processor regions” above
• GoSmarter-hosted infrastructure: All data at rest in our own Azure environment is in UK/EU regions
• Single-region deployment: No customer-selectable regions for our own infrastructure
• Encryption in transit: TLS 1.2 minimum enforced on all services

Request evidence

Need more detail for your compliance review? We can provide:

• Confirmation of Azure region deployment
• Details of data processing activities under GDPR
• Our Data Processing Agreement (DPA)

Email us, contact us online, or book a compliance call.