Trust, privacy, and compliance

EU data residency and where your data lives

In short: Personal data and the Privacy Vault stay in the EU. Core infrastructure runs on AWS in Ireland, with auxiliary workloads in EU regions of Microsoft Azure and Google Cloud. Sub-processors are listed in your account and updated when they change.

EU residency covers the platform’s data layer, not only its main hosting location. This layer includes source, workspace, and user data, the token vault, and logs. The sections below explain how data is handled and where to check the provider list.

Where platform data is stored

Unless states that personal data on the platform stays inside the EU/EEA. Core infrastructure runs on AWS in Ireland, and auxiliary workloads run in EU regions of Microsoft Azure and Google Cloud.

Platform sub-processors are EU entities of AWS, Microsoft Azure, and Google Cloud, and they process data inside the EU. The current sub-processor list is available in your account and is updated when it changes.

How personal data is handled

The Privacy Vault filters personal data when it enters the platform and again at runtime, before a call to a third-party generative model. Sensitive identifiers are removed or masked, or replaced with tokens when personal context is needed.

The model receives filtered text and tokens rather than raw identifiers. The Privacy Vault holds the mapping back to real identifiers, and de-tokenization happens inside the controlled Unless environment.

What is outside this residency scope

Unless’s own business administration may use tools located outside the EU. Those tools do not touch end-user data, so they are distinct from the platform data layer described above.

For procurement or review, you can view the sub-processor list and data flows in the account. The Compliance Center also contains the standard DPA and related compliance documents.

EU residency is supported by both the platform’s EU data locations and controls that limit how personal identifiers are handled. Use the account’s sub-processor list to review the providers involved.