Data Residency
Distronode Corporation • Last Updated: October 10, 2026
Where your data lives
This page shows where each type of data is stored and processed, for a Canadian workspace and for a European one. The table gives the answer for each type of data, per region wherever it differs. The sections below gather everything that still leaves Canada, and everything that still leaves the European Union, in one place each.
We do not claim that your data never leaves your region. We would rather tell you exactly where it lives than round up to a claim we cannot stand behind.
| Data type | Stored in | Processed in | Notes |
|---|---|---|---|
| Contacts & CRM records | Canada (Montreal, PostgreSQL we run ourselves on Amazon Web Services, ca-central-1) | Canada for storage; the AI summaries and the lead enrichment dossier are produced in Montreal (northamerica-northeast1) since September 2026, where they ran in the United States before. The external enrichment providers we may query about a company are separate and are still United States services | Isolated per workspace with row-level security |
| Call records & transcripts (database) | Canada (Montreal, PostgreSQL we run ourselves on Amazon Web Services, ca-central-1) | Canada for storage; AI summarization in Montreal (northamerica-northeast1) since September 2026, both the summary written when a call ends and the analysis that follows it. Transcription depends on the voice engine: Montreal on the one a new Canadian workspace starts on, the United States on the others | Text records, separate from the audio files below |
| Call recording audio files | Nowhere: no call is recorded to storage | Not applicable. A call leaves a call record, a transcript and an AI summary, and unless the business has turned that setting off, the automated assistant tells a caller the call is transcribed | No archived call audio exists. If a recording feature is ever built, this row changes before any call is captured |
| Number registration documents | Your workspace's own region (a dedicated bucket of its own) | Stored in region; submitting a registration sends the documents to the carrier for that number, Twilio, whose regulatory-compliance service runs in the United States | Only for numbers in countries whose regulator requires documents; may include government identity documents for registrations in an individual's name. Deleted 30 days after the number is released or the registration is withdrawn, and immediately with account deletion. New in August 2026 |
| Live call audio (in progress) | Not persisted as media; transient during the call | Browser calls: Montreal for Canadian workspaces, Frankfurt for European ones and Singapore for Asia-Pacific ones, on Amazon Web Services. Read the rest of this entryPhone calls: Every call a Canadian workspace places runs in Montreal, handed to Telnyx at its Montreal site or to Twilio, which carries it in the United States. Calls on the numbers we issue it and on Canadian numbers we issue through Telnyx are answered in Montreal, Twilio's via Ashburn (United States). Calls on European numbers we issue, and on the numbers we issue a European workspace, arrive through Twilio's Dublin edge and run in Frankfurt, as does every call a European workspace places. Every call an Asia-Pacific workspace places, and calls on the numbers we issue it, run in Singapore through Twilio's Singapore edge. Other calls, on a United States workspace's numbers or a customer's own carrier account, run on our United States media node (us-east4). Speech and AI: New Canadian workspaces start on an all-Montreal engine (Amazon Transcribe, Vertex AI, Amazon Polly). Other engines keep the language model in Montreal but run speech in the United States; the realtime engine runs entirely in the United States. New Asia-Pacific workspaces start on an all-Singapore engine on the same three services, with the same exceptions. European speech runs on European endpoints. Our claim stops at each carrier handoff: Telnyx treats processing location as a preference, and Twilio has not confirmed its location in writing. | Real-time media. Who issued the number decides where a call runs; a number on your own carrier account is answered in the United States. |
| Live call events (dashboard updates) | Not stored as a workspace record; carried on an internal message bus to the dashboard | On a message bus in the workspace's region: the United States (us-east4) for United States and Asia-Pacific workspaces, Frankfurt (europe-west3) for European ones, Montreal (northamerica-northeast1) for Canadian ones. It is created where the call runs. That is Frankfurt for a European workspace's calls, placed or received on the numbers we issue it, and for calls on European numbers we issue. It is Montreal for a Canadian workspace's calls, placed or received on the numbers we issue it, and for calls on Canadian numbers we issue through Telnyx. Other calls, such as those on a number on a customer's own carrier account, have their events created in the United States. An Asia-Pacific workspace's calls run in Singapore, and their events are sent to the United States bus. | Only phone-network calls produce events: the caller's name and numbers at the start, the transcript as the call goes and in full at the end, and the summary at the end. Beyond the bus, the live transcript is kept only in memory and dropped shortly after the call. No audio is sent and nothing is recorded. |
| AI language-model inference | Not retained by the model to train foundational models | United States (Google Vertex AI, us-east4). For a European workspace, the language model powering live calls runs in the EU (europe-west4). For a Canadian workspace it runs in Canada (Montreal, northamerica-northeast1) on every voice engine but the realtime one, since September 2026, that engine's model being one Google does not serve from Montreal. Since the same date this covers the dashboard's own AI as well, not only the live call: reply drafts, meeting minutes, post-call analysis, lead dossiers, the console assistant and knowledge-base embeddings. The same holds for an Asia-Pacific workspace in Singapore (asia-southeast1), realtime engine excepted | The receptionist reasoning layer; content is not used to train public models |
| Messages (SMS, MMS, WhatsApp) | Canada (Montreal, PostgreSQL we run ourselves on Amazon Web Services, ca-central-1) for the workspace inbox | Canada for storage; carrier delivery via Twilio, Sinch, or Telnyx in the United States. A routing event carrying the other party's phone number or email address goes to the same message bus as the row above, so the inbox updates without waiting. That is the United States bus for a United States or Asia-Pacific workspace, the European one for a European workspace, and the Canadian one for a Canadian workspace since September 2026. What was written is not sent with it | Controlled by the business that owns the workspace |
| Knowledge base content & questions | Canada (the same regional database), for the documents you upload | Canada, unless the workspace switches to the linked support knowledge base, in which case the text of each question is sent to Atlassian to compose the answer | Your own knowledge base is the default; nothing is sent to a third party to answer from it |
| Support requests you send us | Our support desk, on one Atlassian site in Canada that serves all four regions, plus a copy of the conversation in our own database in the region that received the request | Canada, for every region, deliberately: see the note below the table | Your name, email, subject and message text. For a European, United States or Asia-Pacific workspace this category does not stay in region |
| Account sign-in, directory & number routing | Canada (Montreal, PostgreSQL we run ourselves on Amazon Web Services, ca-central-1) | Canada. A frozen earlier copy of the sign-in, directory, membership and number routing records is kept in the United States so we can roll back, and in our encrypted backups | Each region runs its own sign-in, directory and phone routing, so a Canadian workspace's do not depend on another region |
| Payment & billing records | United States (Stripe) | United States | Name, billing address, payment method, and tax identifiers |
| Email notifications | United States (Postmark) | United States | Delivery of account, verification, and service email |
| Web & app traffic metadata | Cloudflare global edge, then the origin serving your region (Montreal, on Amazon Web Services, for Canadian visitors) | Nearest region and Cloudflare edge | IP addresses and request metadata |
| Operational logs & error diagnostics | New Relic (EU) for infrastructure telemetry and logs; Sentry (EU, Germany) for application errors | Those provider regions, for all four of our regions rather than per region | May include IP addresses and user identifiers |
| Rate limits, caches & operational state | Each region's own, in that region: Montreal for a Canadian workspace, Frankfurt for a European one, Singapore for an Asia-Pacific one and the United States for a United States one | The same region. A request in one region does not touch another region's state. The lock for our own social media publishing jobs, which hold no customer data, is in the United States | Operational state that keeps the service running: rate limits, short-lived caches and webhook idempotency claims. No call audio, transcript, message or contact record. Where a key name would otherwise contain an email address, phone number or IP address, it carries a one-way hash instead |
| Encrypted database backups | Cloudflare R2. European backups are in a bucket created in Cloudflare's European jurisdiction; the United States, Canadian and Asia-Pacific backups are in a bucket in R2's default jurisdiction, each under its own key prefix | None; each region's dump is encrypted inside that region before it is uploaded | A key prefix is a filing convention, not a jurisdiction, which is why the European backups were moved into a jurisdiction bucket of their own. The decryption key is held in a managed secret store, separate from the company that stores the backups. 14 daily and 8 weekly copies retained, then deleted |
| Lead enrichment lookups (opt-in) | Result stored in the workspace (Canada) | United States (People Data Labs, Apollo, and SerpAPI for the web-search step) | Off by default; only business firmographic data |
Choosing a region
You choose your workspace's home region when you sign up. The United States is the default. Canada (Montreal) is available for Canadian businesses, Europe (Frankfurt) for European customers including the UK, and Asia-Pacific (Singapore) for customers in that region.
The Canadian, European and Asia-Pacific regions run on Amazon Web Services: ca-central-1 in Montreal, eu-central-1 in Frankfurt and ap-southeast-1 in Singapore. For a United States workspace, the storage rows that name Canada (Montreal) are served from the United States instead (us-east4, on Google Cloud).
For a Canadian workspace
Your database records (contacts, call records, transcripts and messages) are stored in Montreal on Amazon Web Services. The live audio of a call made or received in the browser is processed in Montreal too.
The AI language model that powers the receptionist runs in Montreal (northamerica-northeast1) on every voice engine except the realtime one. That engine listens and speaks with a single model Google does not serve from Montreal, so a workspace that chooses it is processed in the United States (us-east4), and the engine picker says so. A new Canadian workspace starts on an all-Canadian voice engine that also runs speech recognition and speech synthesis in Montreal. The other engines stay available, each labelled with the region every leg runs in; on those, the two speech legs run in the United States.
The dashboard's own AI features run in Montreal (northamerica-northeast1): suggested reply drafts, meeting minutes, post-call analysis, lead dossiers, the console assistant's answers and the embeddings that make your knowledge base searchable.
The telephony, messaging and custom-connector credentials you store with us are encrypted with a key held in Montreal (northamerica-northeast1).
Phone calls for a Canadian workspace
Every call your workspace places over the telephone network is originated on our equipment in Montreal, whichever carrier carries it. When the carrier is Telnyx, the call is handed over at Telnyx's Montreal site. When the carrier is Twilio, it enters Twilio's United States infrastructure, because Twilio publishes no Canadian point of presence.
Who issued the number, not its country, decides where a call arriving on it is answered. A call arriving on a Canadian number we issued through Telnyx is delivered from Telnyx's Canadian gateway and answered in Montreal.
A call arriving on a Canadian or United States number we issued you through Twilio is answered in Montreal too, delivered from Twilio's Ashburn edge in the United States. Twilio has no Canadian edge, so the phone-network leg and Twilio's own handling are in the United States. A call arriving on a number on your own carrier account reaches us in the United States and runs on our United States media node.
What happens before a carrier hands a call to us, or after we hand one to a carrier, is the carrier's to describe, not ours.
For a European workspace
Your database records are stored in Frankfurt (Amazon Web Services, eu-central-1). Audio for a call made or received in the browser is processed in Frankfurt, the language model for live calls runs in the EU (europe-west4), and speech-to-text runs at European endpoints.
Telephony splits by the number and by who issued it. A call arriving on a European number we issued is delivered by Twilio at its Dublin gateway in Ireland and answered in Frankfurt. A call your workspace places is originated in Frankfurt and handed to our carrier: to Telnyx at its Frankfurt site, or to Twilio through its Dublin edge. A United States number we issued you is answered in Frankfurt too, after United States phone networks; a number on your own carrier account is answered in the United States.
Two things that leave Canada for a Canadian workspace stay in Europe for a European one: error diagnostics (Sentry, Germany) and infrastructure telemetry (New Relic, European Union), and the encrypted database backup, which is written to a bucket in Cloudflare's European jurisdiction.
The telephony, messaging and custom-connector credentials you store with us are encrypted with a key held in Frankfurt (europe-west3).
For an Asia-Pacific workspace
Your database records are stored in Singapore (Amazon Web Services, ap-southeast-1). Audio for a call made or received in the browser or the District app is processed in Singapore. The language model runs in Singapore (asia-southeast1) on every voice engine except the realtime one, which Google does not serve in Asia-Pacific and which runs in the United States (us-east4). A new Asia-Pacific workspace starts on an all-Singapore engine that also runs speech recognition and speech synthesis in Singapore; on the other engines those two legs run in the United States. The dashboard's own AI and knowledge-base embeddings run in Singapore too.
Every call your workspace places is originated on our equipment in Singapore and handed to Twilio at its Singapore edge. A call arriving on a number we issued you is delivered by Twilio through its Singapore edge and answered in Singapore. The numbers are United States numbers, so a call crosses United States carriers before it reaches that edge, and Twilio has not confirmed its processing location in writing. Call events are sent to our message bus in the United States, and our relay there carries them to your dashboard after checking your access against our United States copy of the sign-in records.
Support requests and the linked knowledge base
A few categories of workspace data do not stay wholly inside the region you chose. The first is support. One Atlassian desk, hosted in Canada, receives requests from all four regions, and answers them in English or French. A request from a Canadian workspace stays in its own region; one from a European, United States or Asia-Pacific workspace is held in Canada. For a European workspace, Canada is a country the European Commission recognises as providing adequate protection for personal data held by commercial organisations. Atlassian shows that hosting location only in its administration console, where our administrator confirmed it.
We run one desk rather than four to keep one set of request types, permissions and agent seats. What crosses is a name, an email address and the text you typed. We do not send your IP address, browser details or workspace identifier, and our own copy of the ticket stores a one-way hash of your email, not the address. You can email legal@distronode.com instead of using the form. If you ask us to erase your data, we erase the support conversation on both sides.
If a workspace switches to the linked support knowledge base, the text of each question asked is sent to Atlassian to compose the answer. It is off unless a workspace turns it on.
Live call and inbox events
During a call over the phone network, and when it ends, events about it go to an internal message bus so the dashboard shows it live. Browser meetings and video calls send none. They carry the caller's name and numbers at the start, the transcript as the call goes and in full at the end, and the AI summary at the end. No audio is sent and nothing is recorded.
The transcript as the call goes covers the part our AI handles, one finished turn at a time, for your workspace's members. Beyond the bus, it lives only in our dashboard service's memory, dropped shortly after the call.
For a European workspace the bus is in Frankfurt, for a Canadian one in Montreal, where events are carried, stored and consumed by our dashboard service in that region. United States and Asia-Pacific workspaces use a message bus in the United States.
A European or Canadian workspace's call answered in the United States, such as on your own carrier account, has its event written there, then carried to your region and stored. An inbox event, sent when a message arrives or leaves, carries the other party's number or email, not the text. For a European or Canadian workspace it is created in that region, or in the United States when the geographic router sent you there.
Number registration documents
Some regulators require documents before a number can be registered: a business registry extract, a proof of address, or, for a registration in an individual's name, a government identity document such as a passport. Our copy is stored in a bucket in your workspace's own region and nowhere else.
Submitting the registration sends the documents to Twilio, the carrier for the number, whose registration service runs in the United States; handing them to the regulator's process is the purpose of collecting them. Nothing is sent until you submit. They are deleted 30 days after the number is released or the registration is withdrawn, and with your account when it is deleted.
Shared operational state
Separate from workspace content is the state that keeps the service running: rate limits, short-lived caches and webhook idempotency claims. Each region keeps its own, in that region, and a request in one region does not touch another region's. The lock for our own social media publishing jobs, which hold no customer data, is in the United States.
None of it holds call audio, transcripts, message content or contact records. Where a key name would contain an email address, phone number or IP address, it carries a one-way hash of that value instead. We list it because every request touches it, not because of what it holds.
What still leaves Canada
Beyond the categories above, this is everything that leaves Canada for a Canadian workspace. Each is a choice we have made.
Payment records are held in the United States at Stripe. Sign-in, the directory that routes a telephone number to a workspace, workspace membership, our own subscription records, shared operational state and scheduled jobs for a Canadian workspace are in Montreal. A frozen earlier copy of the sign-in, directory, membership and number routing records is kept in the United States so we can roll back, and in our encrypted backups.
Our sites are reached through Cloudflare's global edge, so the encrypted connection ends at the Cloudflare location nearest the visitor, normally in Canada but not guaranteed; we do not subscribe to Cloudflare's paid option to confine that processing to Canada. Error diagnostics go to Sentry in Germany and infrastructure telemetry and logs to New Relic in the European Union, for all four of our regions, because neither company operates a Canadian region. Account, verification and service email is delivered from the United States by Postmark.
What still leaves Canada, continued
The store for our own secrets is managed by Google Cloud in a global location, not a Canadian one. The optional video avatar is rendered in the United States. Push notifications are delivered by Google's or Apple's messaging service from outside Canada, carrying identifiers only; the app then fetches what it needs under its own credential.
A text message on a Canadian number we issue through Telnyx goes through Telnyx's United States messaging interface. A number on your own carrier account is answered in the United States. A call on a number we issued you through Twilio passes through Twilio in the United States before Montreal, an outbound call carried by Twilio enters Twilio's United States infrastructure, and a call on the realtime voice engine is reasoned in the United States.
The encrypted database backup goes to a Cloudflare bucket whose location Cloudflare chooses; it is encrypted in Montreal first and the key does not travel with it. Optional lead enrichment runs lookups against United States data providers, and only the result comes back to Montreal.
PIPEDA permits these transfers under its accountability model, provided the information stays protected by contractual and organizational safeguards, which we maintain with every sub-processor.
For customers in British Columbia and Alberta
British Columbia's Personal Information Protection Act sets no rule about where a business's personal information is stored.
Alberta's Personal Information Protection Act asks more when personal information reaches a service provider outside Canada, as some of a Canadian workspace's information does. Under section 13.1, a business in Alberta that uses us must tell the people whose information it collects how to get its written policies on service providers outside Canada, and who can answer their questions about it. This page and our sub-processor register describe what leaves Canada and where it goes, so you can point to them in that notice. Questions about our side go to legal@distronode.com.
Section 34.1 requires a business to notify Alberta's Information and Privacy Commissioner, without unreasonable delay, of a loss of or unauthorized access to personal information where a reasonable person would consider there is a real risk of significant harm to an individual. That notice is yours to give, as the organization in control of the information. As our Data Processing Agreement sets out, we notify you without undue delay, and within 48 hours of confirming a breach of security safeguards affecting your workspace's personal information, so that you can give it.
What still leaves the European Union
For a Chapter V question, this is the same list for a European workspace. Each is a choice we have made.
Payment records are held in the United States at Stripe. Sign-in, the number routing directory, workspace membership, our own subscription records, shared operational state and scheduled jobs for a European workspace are in Frankfurt. A frozen earlier copy of the sign-in, directory, membership and number routing records is kept in the United States so we can roll back, and in our encrypted backups. Connections end at the nearest Cloudflare location, normally in Europe but not guaranteed; we do not buy Cloudflare's paid option to confine that to a country.
Email is sent from the United States by Postmark. The store for our own secrets is managed by Google Cloud in a global location, not a European one. The optional video avatar is rendered in the United States, and push notifications, carrying identifiers only, are delivered from outside Europe. Our United States numbers cross United States networks before Frankfurt; a number on your own carrier account is answered in the United States. Texts on our Telnyx numbers go through Telnyx's United States interface. Telnyx stores its records in Canada, but your outbound calls' records in Germany since October 2026. Support requests are held in Canada.
Who each provider is
Every service named on this page is listed on the sub-processor page with its purpose, data category and region. Transfer safeguards are set out in our Data Processing Agreement.