# Where analytics data is stored

> Where Privatus Analytics stores and processes data (the United States), what counts as a transfer for EU, UK and Swiss visitors, and which safeguards apply.

## Storage: United States

All stored data (events, visits, your account and settings, backups and
exports) is kept in our **US region**.

## Processing: United States, in memory

Every visitor request is processed in our US region, including requests
from visitors in the **EU/EEA, the UK and Switzerland**. The IP address
and User-Agent arrive with the request and are used **in memory only**
(bot checks and the daily visit key) while the request is handled. Then they are **dropped**. They are never
written to disk, logs, queues, caches or backups.

## What is transferred

For visitors outside the US, each request is a transfer of personal data
to the US: the IP address and User-Agent exist there in memory for the
duration of the request. What is stored afterwards is the minimized event,
which has no IP address, no raw User-Agent and no persistent identifier.
See the [data inventory](/docs/privacy/data-inventory).

## Transfer safeguards

- the **Standard Contractual Clauses** (2021/914, module 2) in our DPA,
  with the **UK addendum** and the amendments for the **Swiss FADP**,
- minimization: the IP address and User-Agent are processed in memory only
  and never stored.

We are not certified under the EU-US Data Privacy Framework.

## EU hosting

We don't offer EU storage or processing yet. If you need it, join the
waitlist from the website: demand decides when we add an EU region. Our
code is built so that each workspace belongs to a region, which makes
that possible.

## Subprocessors

The current list, with each provider's location and purpose, is on the
[subprocessors page](/legal/subprocessors).