Sovereign.
Data residency you can verify. Four sovereign regions (Canada, the United States, Europe, and Asia-Pacific), regional isolation by architecture, and every legal and security disclosure in one place.
Controls we actually run today, not aspirational language. Where something is planned but not yet in place, you'll find it noted as a roadmap item rather than described as current.
Distronode Corporation • Last Updated: October 10, 2026
On this page
Regional Isolation & Sovereignty
Outside the region
MontréalCanada
Outside the regionpayments, email, texts and some phone services (US); monitoring (EU)
VirginiaUnited States
Outside the regionmonitoring (EU)
FrankfurtEurope
Outside the regionpayments, email, phone and text (US)
SingaporeAsia-Pacific
Outside the regionUS phone networks first; payments, email, phone and text, live call updates (US); monitoring (EU)
- The phone network, before we answer
- Each region's own line, answered to stored
Listening, thinking and speaking show each region's starting voice (Europe: the two engines that run entirely inside the EU). Other voices are labelled with where they run.
We say exactly where your data lives rather than rounding up. Each workspace is stored in its own region: Canadian in Montreal (Amazon Web Services, ca-central-1), United States in us-east4 (Google Cloud), European in Frankfurt (Amazon Web Services, eu-central-1) and Asia-Pacific in Singapore (Amazon Web Services, ap-southeast-1). Stored data stays in its region.
AI runs in the United States under each region's transfer safeguards, with three exceptions. For European workspaces the live-call language model runs in the EU (europe-west4). For Canadian workspaces it runs in Montreal, and for Asia-Pacific workspaces in Singapore, on every voice engine except the realtime one, which Google does not serve in either region. New Canadian workspaces start on an all-Canadian engine, speech included, and new Asia-Pacific workspaces on an all-Singapore one.
A Canadian, European or Asia-Pacific workspace's calls, placed or on our numbers, run in its region (via the United States for Twilio in Canada). European numbers we issue and Canadian ones we issue through Telnyx are answered in their region. A number on your own carrier account is answered in the United States.
Your region is set at onboarding, before any data is stored. We are working toward scheduled region moves, so an established workspace can relocate as its needs change.
Is each region answering, right now
Checked when you opened this page, and again every minute. This tells you a region is answering and how quickly. It does not tell you whether its database or its phone lines are healthy, which is what the hourly check is for.
- United StatesNot checked
- CanadaNot checked
- EuropeNot checked
- Asia-PacificNot checked
Sovereignty Architecture
Network Isolation
Each region's database accepts connections only from our own servers, over verified TLS, with plaintext ports firewalled off. Contacts, transcripts and AI vectors stay in your workspace's region.
Managed Encryption
Storage is encrypted at rest by the region's hosting provider. Credentials you connect, and custom-connector secrets, get a second layer through Google Cloud KMS and are never shared.
Operational Logging
Audit trails stay in your region's database. For every region, infrastructure telemetry goes to our monitoring provider in the EU and error diagnostics to our error-tracking provider in Germany; both are named on the sub-processor page.
Multi-Carrier SIP Routing
We use Twilio, Sinch and Telnyx, connecting from equipment in your region wherever the carrier meets us there. European calls meet Twilio at Dublin both ways, and outbound ones Telnyx at Frankfurt. A Canadian workspace's calls run through Montreal both ways, meeting Telnyx in Montreal and Twilio at Ashburn in the United States. Asia-Pacific calls reach Twilio at Singapore both ways. A number on your own carrier account is answered in the United States.
Security & Trust
Controls we actually run today, not aspirational language. Where something is planned but not yet in place, you'll find it noted as a roadmap item elsewhere on this page rather than described here as current.
| Control | What it means in practice |
|---|---|
| Tenant Isolation at the Database | Every tenant-scoped table is enforced with PostgreSQL Row-Level Security, not application-layer checks alone. A cross-tenant query is rejected by the database itself, even if an application bug were to attempt one. |
| Encrypted in Transit | TLS 1.2 or higher is enforced on every public endpoint. Connections attempting a weaker protocol version are rejected at the edge before they reach our infrastructure. |
| End-to-End Encrypted Meetings | Meeting rooms, the voice demo on this site, the in-app preview where you try your assistant and District HQ voice mode are end-to-end encrypted between the devices in the room and the AI, so the servers that relay the media, including ours, cannot read it. Calls that travel over the telephone network are not, including the ones you place or answer in the app, because the carrier delivers them unencrypted. Neither are sessions with the optional video avatar, whose provider joins without the key. |
| Firewall & Rate Limiting | Managed firewall rules and rate limiting sit in front of authentication endpoints specifically, to blunt credential-stuffing and brute-force attempts before they reach the application. |
| Ongoing Patch Cadence | Container base images are rebuilt and redeployed on a monthly cadence to pick up upstream security patches, independent of feature releases. |
| Managed Secrets | Credentials and API keys live in a managed secret store with scoped access per service. They are never committed to source control or shared over unencrypted channels. |
| Encrypted at Rest | Database storage is encrypted at rest by the provider hosting your region, with keys that provider manages and we never hold. Telephony and messaging credentials you store with us are encrypted again through Google Cloud KMS and are never handed to anyone else. |
| Signed DNS (DNSSEC) | distronode.com and distronode.ca are DNSSEC-signed with delegation records published at their registries, so validating resolvers can detect tampered DNS answers before a connection is ever made. |
EU GDPR Compliance Hub
We honour GDPR data-subject rights and sign Data Processing Agreements with standard contractual clauses.
Right to Erasure (Article 17)
Answered within 30 days. Deleting an account removes contacts, call records, transcripts and messages at once; encrypted backups expire within about eight weeks.
Right to Access & Portability (Articles 15 & 20)
Owners export workspace data as JSON from the dashboard, or ask our Privacy Officer at legal@distronode.com.
International Transfer Safeguards (Chapter V)
Transfers to countries without an adequacy decision, the United States among them, rely on the Commission's standard contractual clauses (with the UK Addendum for UK data) plus technical and organisational safeguards. Transfers to our Montreal region rely on Canada's adequacy decision.
Data Processing Agreements (DPA)
Our standard DPA incorporates the EU clauses (Module Two) and the UK Addendum.
Canada Privacy Hub
Distronode is a Canadian company and District AI is built for the Personal Information Protection and Electronic Documents Act (PIPEDA) and aligned with Quebec's Law 25 (formerly Bill 64). There is no government certification for either law; what matters is what a vendor actually does, so this page states our practices precisely and supports your own compliance obligations.
Privacy Officer
We maintain a designated Privacy Officer to oversee compliance, manage privacy risk audits, and respond to individual access requests. Reach them at legal@distronode.com.
Mandatory Breach Logging
We keep a register of confidentiality incidents, as Law 25 requires. When an incident presents a risk of serious injury, we notify the CAI and the affected individuals promptly.
Privacy by Default
New workspaces start with privacy-protective settings. Lead enrichment and profiling features are opt-in rather than on by default.
Impact Assessments (PIA)
We assess privacy factors before releasing features that involve new uses of personal information or transfers outside Quebec, consistent with Law 25's privacy impact assessment expectations.
Sub-processors
Third parties who process customer data on our behalf as part of running the platform. We vet each one for the safeguards described elsewhere on this page, and we give at least 30 days' notice before adding or replacing one so you can review the change.
The full register (every sub-processor with purpose, data category, and region) is published at distronode.com/sovereign/subprocessors, the address our Data Processing Agreement incorporates by reference. Questions about a specific sub-processor, or how one fits your own vendor review? Contact us at legal@distronode.com.
Accessibility
Distronode is designed and built toward WCAG 2.1 Level AA. We test primary flows, including signup, checkout, and the customer dashboard, against these guidelines and address issues as we identify them. This is a stated target we are actively working toward, not a certified audit result, and we want to be as clear about that distinction here as everywhere else on this page.
Keyboard & Focus
Interactive controls are reachable by keyboard alone and carry a visible focus state, rather than relying on mouse hover to reveal what's actionable.
Screen Reader Labels
Icon-only and non-text controls carry explicit accessible names, so assistive technology announces what a control does, not just that it exists.
Color & Contrast
Text and interface colors are checked for contrast in both our light and dark themes, not just whichever one shipped first.
Ongoing Review
Accessibility is reviewed as part of building new features, not bolted on afterward, and reports from real users take priority over anything we find ourselves.
Report a Barrier If you encounter an accessibility barrier using our product, contact us at accessibility@distronode.com with what you were trying to do and where it broke down. We will prioritize a fix.
Vulnerability Disclosure
Security at Distronode is led by Sean Dean, Founder & CEO, who reads every report sent to security@distronode.com.
We welcome reports of security issues from independent researchers and customers. If you believe you've found a vulnerability in our platform, we want to hear about it before anyone else does.
How to report
Email security@distronode.com with enough detail for us to reproduce the issue: affected URL or endpoint, steps taken, and what you observed versus what you expected.
What we ask of you
Test only against your own account and data, avoid accessing or modifying anything that isn't yours, and give us a reasonable window to investigate and remediate before any public disclosure.
What you can expect from us
Acknowledgment within 2 business days, and ongoing updates as we investigate and work toward a resolution. We do not pursue legal action against good-faith researchers who follow this policy.
Documents
| Document | What it covers |
|---|---|
| Built for PIPEDA | How District AI implements the 10 fair information principles, in plain language. |
| PHIPA-ready | For Ontario health information custodians. We support your obligations, and our written agent agreement is available on request. |
| Quebec Law 25 | Named privacy officer, incident register, consent, and where French-language service stands. |
| GDPR and the European Union | Where a European workspace runs, the transfer basis, the AI Act provider and deployer split, retention, and rights. |
| Data Processing Agreement | A plain-language DPA for small businesses, offered for signature. |
| Sub-processors | The real third parties that process data, with purpose, data category, and region. |
| Data residency map | Where each type of data is stored and processed. We never claim data never leaves Canada. |
| Privacy Policy | How we collect, utilize, and protect your organizational data and telemetry. |
| Terms of Service | The governing agreements, SLA targets, and mutual commitments of platform usage. |