US data residency statement
Generated 23 October 2026 from our subprocessor register.
This statement is also published on our security page: https://barrierops.com/security#residency.
The statement below was last reviewed on 17 September 2026.
The two stores that will hold customer data are both in the United States. The database is Vultr Managed PostgreSQL 18 in New Jersey, a region we last verified on 16 September 2026. Object storage is a Cloudflare R2 bucket created in the US jurisdiction, which we last verified on 1 October 2026.
The R2 jurisdiction is fixed when the bucket is created and cannot be changed afterwards, and it is not a location hint. Our own code refuses to start against a bucket outside it, which makes this the one residency control you can verify by reading our source rather than by believing us.
Compute is in the same place: the API and the scan worker run on Vultr instances in New Jersey, a region we last verified on 16 September 2026. Static hosting runs on Cloudflare’s global edge and holds nothing at rest, which we last verified on 21 October 2026.
The providers that are not yet in use are listed below with their state. Each one’s region is established before the account is created, because for several of them it is fixed at creation and cannot be moved afterwards — which is why it is decided first rather than audited later.
| Provider | What it holds | Region | Fixed when it was created | Region verified | State today |
|---|---|---|---|---|---|
| Vultr | Data in transit and in memory, transient page content, and the services’ own logs on disk | New Jersey, United States | Region, per instance | 16 Sep 2026 | Instances exist, stopped |
| Vultr Managed PostgreSQL | All customer data except binary artifacts, including the evidence ledger | New Jersey, United States | Region, at cluster creation | 16 Sep 2026 | Running |
| Cloudflare R2 — evidence | Screenshots, DOM captures, engine output, documents, reports, exports | Jurisdiction us | Jurisdiction, at bucket creation. Irreversible | 1 Oct 2026 | Bucket barrierops-evidence created |
| Cloudflare R2 — backups | An encrypted logical copy of the database | Jurisdiction us | Jurisdiction, at bucket creation. Irreversible | 3 Oct 2026 | Bucket barrierops-backups created; empty until the first nightly backup runs |
| Cloudflare Workers, DNS | Nothing at rest | Global edge; nothing at rest | Nothing | 21 Oct 2026 | In use |
| WorkOS | Users, memberships and sealed sessions: names, work email addresses, sign-in events | Not yet established | The environment’s data region, at environment creation | Not verified | Test environment only |
| Sentry | Error messages, stack traces, scan and organisation ids | United States | The organisation’s data region. Sentry does not move an organisation | 1 Oct 2026 | Organisation and projects created; nothing sent until deployed |
| Axiom | Service log lines and spans: URLs, ids, timings | United States (US East) | The organisation’s edge deployment | 1 Oct 2026 | Datasets created; nothing is sent until the services are deployed |
| Better Stack | Probe URLs, response bodies of /healthz and the status page text. No customer data | Not yet established | Account region | Not verified | One uptime monitor, paused until the API is live |
| Resend | Recipient addresses and message bodies, kept by Resend for 30 days; once the public barrier-report form is live, the names and addresses of members of the public who report a barrier | United States; sending region US East (Virginia) | The sending region, per domain, when the domain is added. Stored data is held in the United States for every account | 20 Oct 2026 | In use: the worker sends the product’s transactional email from send.barrierops.com |
| GitHub | Source code, CI logs and container images. No customer data | Not applicable | Not applicable | 2 Oct 2026 | Explicitly out of scope, on the record |