> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dairo.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Data residency

> An EU data-residency posture you can read on demand — with an honest note on US legal exposure, not a marketing claim.

When a customer or regulator asks where your data lives, you shouldn't have to
chase the answer over email. `GET /v1/account/residency` returns it as a
structured object you can pull any time: the region, who controls the data, the
full subprocessor list, and a candid note on US legal exposure — phrased honestly
rather than as a marketing claim.

Residency reads with the `account:read` scope.

<CodeGroup>
  ```bash title="cURL" theme={null}
  curl https://api.dairo.app/v1/account/residency \
    -H "Authorization: Bearer $DAIRO_API_KEY"
  ```

  ```ts title="TypeScript" theme={null}
  const residency = await dairo.account.residency();
  console.log(residency.dataResidency, residency.controllerParent);
  console.log(residency.cloudActExposed, residency.noUsEgress);
  for (const s of residency.subprocessors) {
    console.log(s.name, s.role, s.region, s.country, s.status);
  }
  ```

  ```python title="Python" theme={null}
  residency = dairo.account.residency()
  print(residency.data_residency, residency.controller_parent)
  print(residency.cloud_act_exposed, residency.no_us_egress)
  ```

  ```text title="MCP" theme={null}
  Tool: get_compliance_reports   (scope account:read)
  Args: { "action": "getResidency" }
  ```
</CodeGroup>

```json theme={null}
{
  "type": "dairo.residency.v1",
  "primaryRegion": "EU",
  "dataResidency": "EU",
  "noUsEgress": true,
  "controllerParent": "EU",
  "cloudActExposed": true,
  "subprocessors": [
    {
      "name": "Amazon Web Services",
      "role": "Cloud infrastructure and hosting",
      "region": "EU",
      "country": "US",
      "url": "https://aws.amazon.com",
      "status": "active"
    }
  ],
  "subprocessorListVersion": 3,
  "subprocessorListUpdatedAt": "2026-06-01T00:00:00Z",
  "checkedAt": "2026-06-12T10:00:00Z"
}
```

## What the response asserts

* **`dataResidency` / `noUsEgress`** — your data is stored and processed in
  the EU, and `noUsEgress` is `true` when there is no cross-region transfer.
* **`controllerParent`** — the home jurisdiction of the data *controller*
  (Dairo) — the EU.
* **`subprocessors`** — the formal, versioned register
  (`subprocessorListVersion`) of every subprocessor, each with its `role`,
  `region`, `country`, and `status`.
* **`cloudActExposed`** — the honest posture. Dairo does **not** claim CLOUD Act
  immunity: some subprocessors are US-incorporated, so under the US CLOUD Act they
  may in theory be compelled to produce data regardless of where it's stored. When
  this is `true`, that exposure applies.

## The subprocessor register

`subprocessors` is Dairo's published subprocessor list — the third parties that
process data on your behalf, disclosed as GDPR requires. It's versioned, so you
can pin a version and be notified when it changes.

| Field                       | Meaning                                      |
| --------------------------- | -------------------------------------------- |
| `name`                      | The subprocessor's legal name.               |
| `role`                      | What they process on your behalf.            |
| `region`                    | Where they process your data — `EU`.         |
| `country`                   | The subprocessor's country of incorporation. |
| `status`                    | `active` for a current subprocessor.         |
| `subprocessorListVersion`   | Bumped whenever the register changes.        |
| `subprocessorListUpdatedAt` | When the register last changed, in UTC.      |

<Tip>
  Because the response is structured and versioned, snapshot it into your own
  compliance records and diff it over time. Subscribe to the `subprocessor.changed`
  webhook event to be notified the moment `subprocessorListVersion` bumps — the
  signal that the register, or the residency posture, moved.
</Tip>

## Next steps

<CardGroup cols={2}>
  <Card title="Data erasure" icon="eraser" href="/compliance/erasure-jobs">
    Subject erasure with signed deletion certificates.
  </Card>

  <Card title="Tamper-evident audit export" icon="file-signature" href="/compliance/audit-export">
    A verifiable export of the audit trail.
  </Card>

  <Card title="Plans & pricing" icon="building" href="/platform/enterprise-plans">
    Residency, DPAs, and governance controls.
  </Card>

  <Card title="API reference" icon="code" href="/api-reference">
    `GET /v1/account/residency`.
  </Card>
</CardGroup>