Data residency

Where your data lives, current state and EU-residency roadmap.

What this is

Where COHESION stores your scored-interaction data and your org metadata.

Current state

• Edge compute: Cloudflare global Workers network. Requests are served from the closest region to the caller.
• Primary data store: Cloudflare D1, currently provisioned in Cloudflare’s North America region.
• Retention: interactions 24 months; rate_limits 2 hours; alerts and audit_log 90 days.

EU-residency roadmap

• Target Q3 2026: EU-resident D1 database pinned to Cloudflare EU regions, data-isolation mode. Customers on a written EU-residency SLA get routed to this cluster.
• Contractual path available today: Data Processing Agreement (DPA template) with processing limited to Cloudflare infrastructure listed in subprocessors.

Transfer mechanism

For EU-US transfers today, COHESION relies on:

• Cloudflare’s Standard Contractual Clauses (SCCs) with EU customers.
• UK International Data Transfer Agreement (IDTA) for UK.
• Supplementary measures: TLS 1.3 in transit, D1 encryption at rest, peppered SHA-256 key storage.

What to cite to your DPO

• Data Processing Agreement.
• DPIA template covering telemetry capture, JIS scoring, and aggregation.
• Subprocessors list.
• Security posture.

Next step

Trust and compliance for the full mapping.