Skip to main content
Audact
See the offer
All guides
On this page

Data residency

Where Audact stores data and which sub-processors handle it, for DPA and sub-processor register purposes.

This answers "one region or many, and which sub-processors" for DPA / sub-processor register purposes.

Core infrastructure: eu-central-1

Core platform infrastructure — RDS (PostgreSQL, including the evidence chain and pii_vault), AWS KMS (per-tenant HMAC keys, PII encryption keys), and Secrets Manager — runs in eu-central-1. This means:

  • Every evidence_events row, every hash-chain link, every Merkle/RFC-3161 anchor, and every pii_vault ciphertext row is created, stored, and encrypted in the EU.
  • Compliance receipts and HMAC signing (webhook secrets, tool-dispatch secrets) are backed by KMS keys that never leave eu-central-1.

Sub-processors (LLM / STT / TTS) — not AWS-region-pinned

The conversational pipeline calls out to third-party model APIs. These are the vendors' own hosted endpoints, not deployed inside Audact's AWS account, so they are not automatically covered by the eu-central-1 pin above:

FunctionProvider(s)Domicile
LLM (conversation)OpenAIUS
LLM (conversation)MistralFR / EU
STT (speech-to-text)DeepgramUS
TTS (speech synthesis)Voxtral (Mistral)FR / EU, open-weight and self-hostable
  • The per-agent llm_provider allow-list today is {mistral, openai}; stt_provider is {deepgram}; tts_provider is {voxtral}.
  • Cartesia has been removed: it was a US vendor whose EU residency was enterprise-gated, and it was never reachable as the runtime TTS provider at all (Voxtral always won provider selection whenever a Mistral key was configured, which is every real deployment). TTS for all voices, including the female English/British voice, is now fully on Voxtral, which is EU-domiciled and self-hostable.
  • Open decision, not yet made: whether to pin the remaining US-domiciled sub-processors (OpenAI for LLM, Deepgram for STT) to their EU/regional endpoint options, or accept US processing for those two functions. Both vendors offer EU/regional endpoints; Mistral (LLM and TTS) is already EU-only.

Summary for a sub-processor register

  • Audact-operated infrastructure and all persisted/evidentiary data: eu-central-1 (EU).
  • Sub-processors in the call path, with current domicile: OpenAI (LLM, US), Mistral (LLM + TTS, FR/EU), Deepgram (STT, US). Cartesia (formerly TTS, US) has been removed.
  • Pending decision: EU-endpoint pinning for OpenAI and Deepgram.

Source updated: October 19, 2026