EU-resident by default: Relay-hosted content at rest lives in the EU on OVHcloud (Paris / Milan). Residency, not sovereignty - we say what each means, and what happens when you bring your own storage.
Data residency
Everything Relay runs is in the EU: compute, database, search, hosted storage, and backups all live on OVHcloud (a 3-AZ EU region, Paris / Milan). Data stored in Relay-hosted storage stays in the EU - including backups. Semantic-search embeddings are computed by an EU-resident model under a no-training arrangement.
What “by default” means - bring-your-own storage.
“By default” means Relay-hosted storage. If you connect your own storage (BYO), your data at rest lives wherever that bucket is - which may be outside the EU. You choose and control that location. Relay always processes data on EU infrastructure: EU processing for all data, always.
Need a hard guarantee? Turn on EU-only storage - an org-level setting that refuses non-EU BYO targets. For those workspaces, everything, including your storage, stays in the EU.
What “EU residency” means here - and what it doesn’t.
Residency is about where data rests, not a guarantee of EU jurisdiction over every processor. Transactional email is sent from an EU-resident region of a US-parent provider, which remains subject to US law. We say “EU residency,” never “EU sovereignty” or “your data never leaves EU jurisdiction.”
The API and MCP endpoints serve globally - residency governs where data rests, not where you may use it from.
The secrets vault
The vault uses envelope encryption - a per-secret key wrapped under your tenant key, with committing AEAD and full context binding - and is encrypted at rest. Revoking access is an instant ACL removal, and the vault is excluded from the search index.
It is explicitly not zero-knowledge and not end-to-end encrypted. We can technically decrypt and are legally compellable - we will not imply otherwise. Reveal can be gated by optional out-of-band step-up approval and opt-in TOTP. Key-encryption-key custody is held separately from the ciphertext.
Least privilege
Keys are scoped to an action model ({r, w, e, d}) and altitude, and they expire. The management tier is barred from minting agent keys, so a leaked agent key cannot mint keys, touch billing, or disarm its own approval gates.
Tenants are isolated with 404-not-403 responses (no cross-tenant enumeration), an optional per-key IP allowlist, and Argon2id key hashing. These are shipped behaviors, not roadmap.
Found a vulnerability? Report it to security.relay@sairaph.com.
Transparency
The “EU data residency” claim is footnoted to this list, so the badge never out-runs the truth. We do not link fabricated DPAs.
| Sub-processor | Purpose | Residency | Honest note |
|---|---|---|---|
| OVHcloud | EU hosting (compute, database, search) + object storage + key custody | EU (FR, Gravelines) | EU-resident, no-training. Relay-hosted content at rest lives here. |
| Mistral AI | Semantic-search embeddings (mistral-embed) + OCR for scanned / image pages | EU (FR, Paris) | EU-resident, no-training. OCR runs on the Batch API by default (roughly 30-day retention, not zero-retention) - we disclose this rather than claim ZDR. |
| AWS SES | Transactional email | EU (eu-west-1, Ireland) | EU-resident region of a US-parent processor. Transfers rely on the EU Standard Contractual Clauses / EU-US Data Privacy Framework - resident, not sovereign. |
| Stripe | Payments and checkout | US (global) | PCI-handled; no card data touches our servers. Transfers rely on the EU Standard Contractual Clauses / EU-US Data Privacy Framework. |
| Telegram | Optional notification channel | Non-EEA | Opt-in only, no DPA; metadata-only pings, never secret values or codes. May be removed at launch. |
The legal pages spell out the processor split, residency, and retention - in plain language.
Unlimited agents on every plan · no per-seat fees · EU-resident by default
"By default" means Relay-hosted storage: connect your own bucket (BYO) and your data at rest lives wherever that bucket is - your choice, and possibly outside the EU. Relay always processes data on EU infrastructure.