Where analytics data is stored

Where Privatus Analytics stores and processes data (the United States), what counts as a transfer for EU, UK and Swiss visitors, and which safeguards apply.

# Where analytics data is stored

> Where Privatus Analytics stores and processes data (the United States), what counts as a transfer for EU, UK and Swiss visitors, and which safeguards apply.

## Storage: United States

All stored data (events, visits, your account and settings, backups and
exports) is kept in our **US region**.

## Processing: United States, in memory

Every visitor request is processed in our US region, including requests
from visitors in the **EU/EEA, the UK and Switzerland**. The IP address
and User-Agent arrive with the request and are used **in memory only**
(bot checks and the daily visit key) while the request is handled. Then they are **dropped**. They are never
written to disk, logs, queues, caches or backups.

## What is transferred

For visitors outside the US, each request is a transfer of personal data
to the US: the IP address and User-Agent exist there in memory for the
duration of the request. What is stored afterwards is the minimized event,
which has no IP address, no raw User-Agent and no persistent identifier.
See the [data inventory](/docs/privacy/data-inventory).

## Transfer safeguards

- the **Standard Contractual Clauses** (2021/914, module 2) in our DPA,
  with the **UK addendum** and the amendments for the **Swiss FADP**,
- minimization: the IP address and User-Agent are processed in memory only
  and never stored.

We are not certified under the EU-US Data Privacy Framework.

## EU hosting

We don't offer EU storage or processing yet. If you need it, join the
waitlist from the website: demand decides when we add an EU region. Our
code is built so that each workspace belongs to a region, which makes
that possible.

## Subprocessors

The current list, with each provider's location and purpose, is on the
[subprocessors page](/legal/subprocessors).

Ver como Markdown

Storage: United States#

All stored data (events, visits, your account and settings, backups and exports) is kept in our US region.

Processing: United States, in memory#

Every visitor request is processed in our US region, including requests from visitors in the EU/EEA, the UK and Switzerland. The IP address and User-Agent arrive with the request and are used in memory only (bot checks and the daily visit key) while the request is handled. Then they are dropped. They are never written to disk, logs, queues, caches or backups.

What is transferred#

For visitors outside the US, each request is a transfer of personal data to the US: the IP address and User-Agent exist there in memory for the duration of the request. What is stored afterwards is the minimized event, which has no IP address, no raw User-Agent and no persistent identifier. See the data inventory.

Transfer safeguards#

the Standard Contractual Clauses (2021/914, module 2) in our DPA, with the UK addendum and the amendments for the Swiss FADP,
minimization: the IP address and User-Agent are processed in memory only and never stored.

We are not certified under the EU-US Data Privacy Framework.

EU hosting#

We don't offer EU storage or processing yet. If you need it, join the waitlist from the website: demand decides when we add an EU region. Our code is built so that each workspace belongs to a region, which makes that possible.

Subprocessors#

The current list, with each provider's location and purpose, is on the subprocessors page.