Data Residency & Processing Locations

The EU commitment applies to Customer Content, including prompts, uploaded documents, saved workspace materials and generated outputs, and to associated Customer Data processed to operate Veritas Ask. It covers storage and active processing, including AI inference, service logs and copies containing Customer Data. EU incorporation of the operator is separate from this processing commitment.

Detailed infrastructure sites are not published. Contracting institutions receive the legal-entity and country information needed for their assessment through the agreed supplier and security schedules, without disclosure of unnecessary infrastructure details on the public website.

Any entity actually processing Customer Data on our instructions must respect the agreed EU boundary for that processing. This includes any remote support or administrative access; locating a database in the EU does not itself permit third-country access. Roles are assessed by operation and legal relationship, not merely by technology used. Actual subprocessors are subject to the DPA’s registration and authorisation requirements. This document does not assert that every technical supplier is a subprocessor.

Support must be limited to the information and permissions needed for the issue. Initial reports should identify the account, function and error without sending a complete confidential file. Any necessary exchange of confidential evidence uses an agreed appropriate channel. A public contact form is not a secure case-file intake workflow.

There is no standard exception authorising routine Customer Data processing outside the EU. A proposed change requires a prior documented agreement, assessment of applicable law and any required transfer safeguards or institutional approvals before the affected processing. An adequacy decision or transfer clause does not alone override the contracted location commitment. If the requirement cannot be met, the affected processing must not proceed.

A binding legal demand is assessed individually under the DPA and applicable law, with notice where lawful and minimum required disclosure. This is not a general contractual permission to move processing. Customer-initiated access, downloads or disclosures from another country are separate acts under the Customer’s control; they do not authorise a supplier location change.

EU processing does not itself prove a security certification, regulatory authorisation, public-sector cloud-catalogue entry, zero retention, immunity from legal process or suitability for every data classification. The Terms, DPA, TOMs and Enterprise Terms address these separate matters. Storage, inference, training restrictions, retention and professional authority must be assessed separately.