Data residency and Data Processing Agreements
Where your data lives and who's accountable for it are usually the first questions in a security review. Here's how G8KEPR handles both.
Where your data lives
- ▸Hosted platform — G8KEPR's hosted service runs in a single US region today.
- ▸Your VPC — run the full platform inside your own cloud account (Starter and up), so traffic and data stay in your infrastructure and region.
- ▸On-prem or air-gapped — for the strictest requirements, deploy entirely within your own network (Enterprise).
If data residency outside the US is a hard requirement, self-hosting in your VPC is the path — see Deploy G8KEPR in your VPC.
Data Processing Agreements
A DPA is available and covers how G8KEPR processes personal data on your behalf when you use the hosted platform. If you handle health data, a BAA covers PHI specifically (see HIPAA evidence and BAAs).
Retention and deletion
In a self-hosted deployment, retention and deletion are entirely under your control — the audit log and records live in your own PostgreSQL instance. On the hosted platform, retention follows your plan; contact your account team to confirm the current terms for your organization.
Multi-region and full high-availability are supported in self-managed deployments but depend on your infrastructure — they aren't automatic on the hosted single-region service.