Skip to main content
Truthlocks allows you to pin all tenant data to a specific geographic region. Once configured, your data — including users, attestations, evidence, files, and audit logs — is stored and processed exclusively within that region.

​
Supported regions

Region codeLocationGovernanceDefault for
USNorthern Virginia, USAUS LawGlobal and US tenants
EUDublin, IrelandGDPR / EU LawEuropean tenants
AFCape Town, South AfricaZA LawAfrican tenants
Your region is assigned when your tenant is created, based on your organization’s country. It can only be changed by contacting your account manager.

​
What stays in your region

All tenant-scoped data is guaranteed to remain within the selected region:
  • Identity — users, roles, permissions, and API keys
  • Business data — issuer profiles, attestations, evidence, verification results, and consumer inboxes
  • Files — all attachments and evidence documents (stored in region-specific buckets)
  • Billing — usage records and invoices
  • Audit logs — your complete audit trail
Some data is considered global and may be replicated for performance: public documentation, marketing content, public transparency checkpoint metadata, and SDK artifacts. This data does not include PII or tenant-scoped business data.

​
How enforcement works

Each region runs as an independent deployment stack. When you make an API request, the platform verifies that your tenant’s assigned region matches the region of the stack processing the request. If there is a mismatch, the request is rejected with an HTTP 409 Conflict response: 
{
  "code": "REGION_MISMATCH",
  "message": "Data Residency Violation: tenant is pinned to region EU but request was routed to US.",
  "http_status": 409
}
This enforcement applies to every authenticated API call, ensuring that no tenant data is accidentally processed outside its designated region.

​
Region locking

By default, your tenant’s region is locked after creation. This prevents accidental region changes and provides an additional compliance safeguard.
  • Locked — the region cannot be changed through normal API calls. This is the default.
  • Unlocked — a platform administrator has temporarily unlocked the region for migration purposes.
Region changes do not automatically migrate data. If your region is changed, data must be manually migrated to the new region’s infrastructure. Contact your account manager to coordinate a region change.

​
Choosing a region

Select the region that best aligns with your regulatory requirements:
RequirementRecommended region
GDPR complianceEU (Dublin)
US federal or state data lawsUS (Northern Virginia)
African data sovereignty (e.g., POPIA)AF (Cape Town)
No specific requirementUS (default)
If you are unsure, start with the default (US). You can request a region change later by contacting support.

​
Checking your region

You can verify your tenant’s current region from the console at Settings > Organization, or by querying the API: 
curl https://api.truthlocks.com/v1/identity/orgs \
  -H "X-API-Key: tl_live_..."
The response includes your region code: 
{
  "id": "org_abc123",
  "name": "Acme Corp",
  "region_code": "EU",
  "residency_lock": true
}

​
Frequently asked questions

Automated migration is not supported in the current version. Contact your account manager for manual migration assistance. The process involves provisioning your data in the target region and updating your tenant’s region assignment.
Users can access the platform from anywhere, but all data remains in your tenant’s home region. Latency may vary depending on user location relative to your assigned region.
Payments are routed based on your country, not your data residency region. See provider routing for details on how payment providers are selected.

Compliance & certifications

GDPR, SOC 2, and other compliance standards.

Row-level security

How tenant data is isolated at the database level.

Audit logs

Track all actions within your tenant.

Provider routing

How payments are routed by region.