Data Residency
FORG Enterprise allows you to pin your organization's data to a specific geographic region. This is relevant for regulatory requirements such as GDPR, PDPA, and sector-specific mandates that restrict cross-border data transfers.
Available regions
| Region | Code | Location |
|---|---|---|
| United States | us | us-east-1 (Virginia) |
| European Union | eu | eu-west-1 (Ireland) |
| Asia Pacific | ap | ap-southeast-1 (Singapore) |
What data residency covers
When a region is configured, the following data is stored and processed exclusively within that region:
- Signal telemetry (model usage, token counts, costs)
- Session and project metadata
- Rule definitions and evaluation results
- Audit log entries
- User profiles and team membership
The following is not subject to data residency — it is always global:
- License and identity verification (performed at activation time only)
- Release manifest distribution
- Support ticket data
Configuring data residency
Data residency is configured at org creation time. Existing orgs can migrate regions with a support-assisted process that includes a data export, re-ingestion, and a maintenance window. To initiate a region migration, contact hello@forg.pro.
New Enterprise orgs can select their region during onboarding. The selected region appears in Dashboard → Settings → Data Residency and cannot be changed self-service after onboarding.
Data Processing Agreement
FORG offers a Data Processing Agreement (DPA) for Enterprise customers. The DPA documents our role as a data processor, the categories of data processed, your rights as a data controller, and our sub-processor list. Request the DPA at hello@forg.pro.
Sub-processors
FORG uses the following sub-processors for data storage and processing:
| Sub-processor | Purpose | Regions |
|---|---|---|
| Cloudflare | Edge network, Workers runtime | Global (pinned by region) |
| Supabase / PostgreSQL | Signal and user data storage | us, eu, ap |
| AWS SES | Transactional email | us-east-1 |
| Stripe | Payment processing | Global |
Sub-processor updates are communicated via the changelog with 30 days notice.