Network & residency
Your workspace pins a jurisdiction. That pin rides every call — standard runs included — and several parts of this system would rather stop than run somewhere the pin does not cover. Those refusals are quoted below, verbatim from the code.
Workspace region
CH is the default for a new workspace. Change it in Settings → Security & Data.
Where compute runs
“The cloud” is not an answer to a residency question. These are the four systems your data can touch, what each holds, and which agreement covers it.
Residency · Global PoPs, with per-customer region selection available on Cloudflare Enterprise — the plan on which the BAA is offered. See /legal/subprocessors §2.
Residency · US or EU per project; Ireland for EU workloads, as named in DPA Article 8. HIPAA eligibility requires the Supabase HIPAA add-on on the operating organisation.
Residency · The region is the placement decision; X-PHI is only the catalogue decision. Both are sent — see /routing for how they are resolved.
Residency · Our own VM, in-region, no egress; the network security group admits port 443 only from Cloudflare’s egress ranges.
The region pin
PHI and standard are a separate axis: X-PHI picks which model catalogue is eligible, the region picks the ground the work is allowed to stand on. Both are sent. Zeroing the region on a standard run once broke every standard code-strategy reshape, which is exactly how load-bearing it is.
| Region | What it means | Sandbox placement | Notes |
|---|---|---|---|
| CH | The default for a new workspace | Placeable | Swiss-resident inference under nFADP. The Excel runner’s reference deployment is switzerlandnorth. |
| EU | EU-resident processing | Placeable | Supabase runs in Ireland for EU workloads (DPA Art. 8). GDPR with SCCs in the DPA. |
| UK | UK-resident processing | Placeable | Covered by the same DPA under UK GDPR / DPA 2018. |
| US | US-resident processing | Placeable | The region the general (non-PHI) model ladder pins itself to, because those model rows serve US. |
| WORLD | No pin | Not placeable | The program sandbox refuses a run with this setting rather than choosing a jurisdiction for you. |
Workspace regions come from ALLOWED_REGIONS in lib/workspaceSettings.ts; the placeable set is SANDBOX_REGIONS in lib/reshape/sandbox.ts. WORLD is deliberately absent from the second list.
Retention is pinned in the same place: uploads are held for 0, 24, 168 or 720 hours, with 24 the default and the underlying Cloudflare KV TTL doing the expiry. See what we store and for how long.
Fail-closed
Fail-open is the default failure mode of most infrastructure, and it is the wrong one for regulated data. Each of these paths refuses, names the variable that would have permitted it, and returns a message you can put in a ticket.
Verbatim · “sandbox requires a jurisdiction with a compliant placement (one of CH, EU, UK, US); workspace region is unset” — sandboxPreflight() in lib/reshape/sandbox.ts.
Verbatim · “phi_host_not_baa_covered: MAPR_PHI_ALLOWED_HOSTS unset in production — full-data PHI requests cannot be routed without an explicit BAA-host allowlist” — lib/llm.ts. /api/health reports the same component as down.
Verbatim · “excel_runner_not_phi_covered: this run is PHI-routed but MAPR_EXCEL_RUNNER_PHI_OK is not set — the runner host is not declared inside the BAA boundary” — excelRunnerRefusal() in lib/excelRunner.ts.
Verbatim · “sandbox requires a per-tenant phi-cloud key; refusing to bill the platform account” — sandboxPreflight() in lib/reshape/sandbox.ts.
The Excel runner
We read macros without executing them everywhere else in the product. Executing one needs a real Excel, so it happens on a machine we operate and fence — and that machine is refused PHI traffic until it is explicitly declared inside the BAA boundary.
# infra/excel-runner — the posture, not the marketing version.
Host Windows VM we operate, licensed Excel, in-region
(switzerlandnorth for the CH default)
Network No egress. NSG admits :443 from Cloudflare ranges only.
Transport https required (MAPR_EXCEL_RUNNER_URL), bearer key
Concurrency One run at a time — a second request gets 503 busy
Process New Excel process per run (DispatchEx), killed on
timeout (max 300 s) or on any exit path
PHI Refused unless MAPR_EXCEL_RUNNER_PHI_OK=1 declares the
host inside the BAA boundary
Outage The checked code still ships, flagged execution_skippedReading is free and deterministic
The macro report — modules, entry points, risky-call signals, Excel 4.0 macro sheets — is produced by parsing the file. No execution, no model, no charge.
A password is not encryption
A DPB-protected VBA project is a UI lock. We recover the source regardless, and we never present that flag to you as protection.
Execution is opt-in and metered
Running a procedure is billed per second with a five-second floor, and a PHI-routed run pays the same 20% uplift as the rest of the charge.
An outage does not fake a result
If the runner is unreachable, the authored and checked code still ships — flagged execution_skipped, so you know it was never actually run.
Residency, per workspace
Set the region once in Settings → Security & Data. Every run carries it, and the parts that cannot honour it stop rather than improvise.