Relay-hosted content at rest in the EU, a server-mediated secrets vault stated without overclaiming, audit logging, and least-privilege keys - with a DPA and sub-processor list written in plain language.
The fit
Compliance teams reward honesty over marketing superlatives. We state EU residency as residency, scope it to what Relay hosts, describe the vault as server-mediated rather than zero-knowledge, and publish an accurate, per-processor sub-processor list.
What you get
EU-resident by default
Relay-hosted content at rest stays in the EU on OVHcloud, backups included - and an org-level setting can enforce EU-only storage for BYO buckets.
Honest vault
Server-mediated, encrypted at rest, ACL-gated. We never claim end-to-end or zero-knowledge.
Least privilege
Scoped, expiring keys; management-tier barred from agent keys; per-tenant isolation with no enumeration.
Readable legal
A DPA and a per-processor sub-processor list - accurate about retention, residency, and parent jurisdiction.
Unlimited agents on every plan · no per-seat fees · EU-resident by default
"By default" means Relay-hosted storage: connect your own bucket (BYO) and your data at rest lives wherever that bucket is - your choice, and possibly outside the EU. Relay always processes data on EU infrastructure.