Data residency

When a customer or regulator asks where your data lives, you shouldn't have to chase the answer over email. GET /v1/account/residency returns it as a structured object you can pull any time: the region, who controls the data, the full subprocessor list, and a candid note on US legal exposure — phrased honestly rather than as a marketing claim.

Residency reads with the account:read scope.

curl https://api.dairo.app/v1/account/residency \
  -H "Authorization: Bearer $DAIRO_API_KEY"

{
  "type": "dairo.residency.v1",
  "primaryRegion": "EU",
  "dataResidency": "EU",
  "noUsEgress": true,
  "controllerParent": "EU",
  "cloudActExposed": true,
  "subprocessors": [
    {
      "name": "Amazon Web Services",
      "role": "Cloud infrastructure and hosting",
      "region": "EU",
      "country": "US",
      "url": "https://aws.amazon.com",
      "status": "active"
    }
  ],
  "subprocessorListVersion": 3,
  "subprocessorListUpdatedAt": "2026-06-01T00:00:00Z",
  "checkedAt": "2026-06-12T10:00:00Z"
}

What the response asserts

• dataResidency / noUsEgress — your data is stored and processed in the EU, and noUsEgress is true when there is no cross-region transfer.
• controllerParent — the home jurisdiction of the data controller (Dairo) — the EU.
• subprocessors — the formal, versioned register (subprocessorListVersion) of every subprocessor, each with its role, region, country, and status.
• cloudActExposed — the honest posture. Dairo does not claim CLOUD Act immunity: some subprocessors are US-incorporated, so under the US CLOUD Act they may in theory be compelled to produce data regardless of where it's stored. When this is true, that exposure applies.

The subprocessor register

subprocessors is Dairo's published subprocessor list — the third parties that process data on your behalf, disclosed as GDPR requires. It's versioned, so you can pin a version and be notified when it changes.

Next steps