For reviewers who have to name the region in writing
Where your data physically lives
One region, and only one: Frankfurt, Germany — DigitalOcean fra1. The cluster, the database, the routing state, the attachments and every backup of them are in it. Below is each store, one row at a time.
- Region: fra1 — Frankfurt, Germany
- Controller of the contract: Testreel OÜ, Estonia
- No second region, no US failover
Every place your data is
Not a list of stores — a list of places, which is what a register asks for. Every class of data the platform holds, drawn inside the boundary it sits in, with the only things that leave it hanging below. Set it to how you would actually run it.
How you would run it
The hosted platform with every feature turned on. This is the state the rest of this page describes.
1regionfra1 — Frankfurt, Germany. Every store the platform keeps is in it, backups included. There is no second region and no failover outside it.
Inside the EEA
Frankfurt, Germany (fra1)8 stores
Held by DigitalOcean.
- Account records
- Workspace configuration
- Task content
- Attachments
- Routing state
- Decision traces
- Control-plane backups
- Routing-state backups
European Union (PostHog EU Cloud)1 store
Held by PostHog.
- Marketing-site analytics
Every store, one row at a time
The figure above counted them. This is the part you can quote: each store, what is in it, and who holds it — answering to the same control.
What you send us
Everything that enters Fivexer because you or your workers put it there.
Account records
Names, email addresses, password hashes, session records. Held by DigitalOcean.
Workspace configuration
Teams, skills, routing rules, API keys, worker identities. Held by DigitalOcean.
Task content
Everything you send us to route, including its description and comments. Held by DigitalOcean.
Attachments
Files uploaded against a task, in object storage. Held by DigitalOcean.
What the engine produces
State and evidence the routing engine creates while it runs, and the copies of both.
Routing state
Queues, backlogs, who holds what right now. Held by DigitalOcean.
Decision traces
Who was eligible for each task, who was ruled out, and why. Held by DigitalOcean.
Control-plane backups
Automated database backups, same region as the database. Held by DigitalOcean.
Routing-state backups
Append-only-file persistence on a volume in the same cluster. Held by DigitalOcean.
What reaches a third party
The only rows where a company other than us is involved.
Marketing-site analytics
Anonymous pageviews on the public site. Never the console, never the API. Held by PostHog.
Transactional email
United States
The recipient address and the message — verification, resets, portal invitations. No task content. Held by SendGrid (Twilio). Outside the EEA — safeguard: Standard Contractual Clauses in the provider’s data processing addendum.
Worker-Portal Studio prompts
United States
Only the prompts and portal source files exchanged while building a portal. Opt-in feature. Held by DigitalOcean Inference. Outside the EEA — safeguard: Standard Contractual Clauses in the provider’s data processing addendum.
The copies stay with the originals
Every backup stays in the region of the store it copies — stated per store, because they genuinely differ per store.
Control plane (accounts, workspaces, tasks)
Frankfurt
DigitalOcean's default automated backups for managed databases, in the same region as the database it copies.
Routing state (queues, backlogs, ownership)
Frankfurt
append-only-file persistence on a persistent volume, single instance, on a volume in the same cluster — a single instance, not a replicated fleet.
Has a restore actually been run?
Yes
A full restore has been run and verified — backups are tested, not assumed.
Questions about the region
The short answers, written to be lifted straight into the register you are filling in.
Which region does Fivexer run in?
One region: DigitalOcean fra1, Frankfurt, Germany. The Kubernetes cluster, the managed Postgres database, the Redis routing state and the object storage for attachments are all in it. There is no second region and no US failover.
Are backups kept in the EU too?
Yes. Managed-database backups stay with the database in Frankfurt, and routing state persists to an append-only file on a volume in the same cluster. Restores are tested rather than assumed. No backup copy leaves the region.
Do task attachments leave the EU?
No. Attachments go to object storage in the same Frankfurt region as everything else, and no subprocessor outside the EEA receives task content of any kind — including the transactional email provider, which only ever sees the recipient address and the message body.
Can we choose a different region?
Not today — Fivexer Cloud runs in Frankfurt for every customer, and offering a choice we cannot yet keep would be the wrong answer. If you need data in a specific country, self-host the MIT engine on your own infrastructure and choose the region yourself.