Data residency

Where your sessions are stored, and how to pin a region for compliance.

Default

Sessions are stored in our managed storage tier. The default region follows your traffic — the API writes to the edge region closest to the origin of the POST. For most Tanzania-first apps, that's Europe (eu).

What's stored

DataRetentionNotes
Session events (DOM, clicks, network)90 days (free) / configurable (paid)Compressed, gzipped
Screen frames (RN)90 daysJPEG blobs
Error payloads + stack traces90 daysIndexed for search
User traitsForever (until deletion)Attached to visitor
Visitor IDsForeverPersists across sessions

Pinning a region

For GDPR, Tanzanian data-protection, or HIPAA-adjacent compliance, you can ask us to pin your project to a specific region so data never leaves that jurisdiction.

Available regions on request:

RegionData center
euFrankfurt, Germany
us-eastAshburn, Virginia
ap-southMumbai, India
af-southJohannesburg, South Africa

Email kelvin@galacha.me with your project ID and desired region. We configure the routing server-side, no SDK change needed.

Encryption

LayerMechanism
In transitHTTPS (TLS 1.2+)
At restAES-256 at the storage layer
BackupsEncrypted, region-local, 30-day retention

Project keys are hashed before indexing. The raw key is never logged.

Subprocessors

We use the following third parties to operate the service:

VendorPurpose
CloudflareCDN, DDoS protection
Fly.ioCompute
Our managed storage tierLong-term session storage

Full subprocessor list and DPA templates available on request.

Deletion

See Deleting user data.

Related