Network & residency
Where your data is processed is a setting, not a hope.
Your workspace pins a jurisdiction. That pin rides every call — standard runs included — and several parts of this system would rather stop than run somewhere the pin does not cover. Those refusals are quoted below, verbatim from the code.
Workspace region
- CHPlaceable
- EUPlaceable
- UKPlaceable
- USPlaceable
- WORLDNot placeable
CH is the default for a new workspace. Change it in Settings → Workspace.
Where compute runs
Three places, and what each one is allowed to hold.
“The cloud” is not an answer to a residency question. These are the three systems your data can touch, what each holds, and which agreement covers it.
Edge — the API and the dashboard
State — the account database
Compute — models and the program sandbox
Macros are read, never run
We parse the VBA project out of a workbook and report what it contains — modules, entry points, risky-call signals — but nothing in this system executes it. There is no Excel host, so there is no residency question to answer about one. Macro EDITING is delegated to monopea and travels with the same region and data-class headers as every other model call.
How · lib/vba.ts implements the three stacked container formats by hand and is fail-soft throughout: a container we cannot parse is still reported as macro-bearing, never as clean.
- CH · EU · UK · US placement
- X-Region on every PHI call
- Sandbox refuses region-less runs
- BAA host allowlist fails closed
- Upload retention is yours to set
The region pin
One setting decides where compute may run.
PHI and standard are a separate axis: X-PHI picks which model catalogue is eligible, the region picks the ground the work is allowed to stand on. Both are sent. Zeroing the region on a standard run once broke every standard code-strategy reshape, which is exactly how load-bearing it is.
| Region | What it means | Sandbox placement |
|---|---|---|
| CHSwiss-resident inference under nFADP. This is the default region for a new workspace. | The default for a new workspace | Placeable |
| EUPHI-routed model calls stay on EU-resident providers. GDPR with SCCs in the DPA. | EU-resident processing | Placeable |
| UKCovered by the same DPA under UK GDPR / DPA 2018. | UK-resident processing | Placeable |
| USThe region the general (non-PHI) model ladder pins itself to, because those model rows serve US. | US-resident processing | Placeable |
| WORLDThe program sandbox refuses a run with this setting rather than choosing a jurisdiction for you. | No pin | Not placeable |
Fail-closed
Three places this system stops instead of guessing.
Fail-open is the default failure mode of most infrastructure, and it is the wrong one for regulated data. Each of these paths refuses, names the variable that would have permitted it, and returns a message you can put in a ticket — the text under each card is the string the code actually emits.
No jurisdiction, no run
No allowlisted host, no PHI
No tenant key, no sandbox
How long it stays
Retention is a setting, and 24 hours is only its default.
A residency answer is half an answer without a clock. Parsed uploads expire on Cloudflare KV’s own native TTL, and the number that TTL is built from is yours.
| retention_hours | Uploads survive |
|---|---|
| 0Delete on commit. The entry is never written to KV at all — its TTL is already in the past, so the write is skipped — and the commit handler deletes the in-memory copy and the database record. An upload that is never committed keeps its database record (headers, clamped sample, mappings; full rows cleared within 15 minutes) until the workspace is erased. | Nothing survives the request |
| 24The default for a new workspace, and the value you get if the settings row cannot be read. | 24 hours |
| 168For an import you finish over a working week. | 7 days |
| 720The longest window the setting offers. | 30 days |
Retention governs the parsed upload — the transient copy the cascade works from. What the account itself holds, for how long, and who is allowed to read it back is a longer list: what we store and for how long.