Trust Center / Hosting
Frankfurt core placement, with named processor exceptions.
Core application Functions and product data are placed in Frankfurt. Named subprocessors may process limited data elsewhere, including Resend email metadata and logs in the United States, as disclosed in the trust center and DPA.
- Core application compute
- Vercel Node.js Functions placed in Frankfurt, region fra1.
- Static delivery and routing
- Vercel uses a global CDN for static assets. Routing, preview deployments, logs, support, and control-plane processing may involve other locations.
- Product data
- Supabase PostgreSQL, Auth, Queues, Cron, and private Storage placed in Frankfurt, eu-central-1.
- Backups
- [BACKUP REGION AND RESTORE BEHAVIOR PENDING PRODUCTION CONFIRMATION]
- Transactional email
- Resend uses an Ireland sending region. Account data, email metadata, logs, and API records are stored in the United States, with standard 30-day email-data retention.
- Connector key storage
- Azure Key Vault region is [PENDING PRODUCTION CONFIRMATION]. Connector signing keys remain non-exportable.
- Logs
- Application and provider log regions, retention, and support access paths are [PENDING PRODUCTION CONFIRMATION]. Raw Microsoft payloads are excluded from logs.
- Support access
- Named-account, MFA-protected, approved, and time-bounded production access. Final support-access locations are [PENDING PRODUCTION CONFIRMATION].
- Billing
- Stripe processes billing and payment data under its disclosed processing locations and transfer terms. ChangeWitness does not store card details.
- Customer destinations
- Slack, Teams, email recipients, and generic webhooks can create destination-dependent transfers selected by the customer.
Residency Statement
What ChangeWitness can state accurately at launch.
Core application Functions and product data are placed in Frankfurt. Named subprocessors may process limited data elsewhere, including Resend email metadata and logs in the United States, as disclosed in the trust center and DPA.