Data Residency

Five categories above do not stay wholly inside the region you chose, and we would rather name them than bury them. The first is support: one Atlassian desk, hosted in Canada, receives requests from all four regions. A request sent from a European, United States or Asia-Pacific workspace is therefore held in Canada rather than in that region; a request from a Canadian workspace stays in its own region.

For a European workspace that transfer is to a country the European Commission recognises as providing adequate protection for personal data held by commercial organisations. Atlassian publishes that hosting choice only in its administration console, and our organisation administrator read it there in August 2026.

We chose one desk over four because four would mean four sets of request types, permissions and agent seats to keep in step, and what crosses is a name, an email address and the text you typed.

We keep those tickets deliberately thin. We do not send your IP address, your browser details or your workspace identifier, and our own copy of the ticket stores a one-way hash of your email rather than the address itself. If you would rather not use the form, email legal@distronode.com instead. If you ask us to erase your data, we erase the support conversation with it, on both sides.

The second is the linked support knowledge base. If a workspace switches its knowledge base from the documents it uploads to the linked support knowledge base, the text of each question asked is sent to Atlassian to compose the answer. It is off unless a workspace turns it on.

The third is live call telemetry. While a call is in progress and when it ends, we send an event describing the call to an internal message bus, so the dashboard can show the call as it happens. It covers calls carried over the phone network, in either direction; a meeting or video call held in the browser produces no such event. The event carries the caller's name and the phone numbers when the call starts, and the transcript, the AI summary and the link to the recording when it ends; the call audio itself is not sent.

For a United States or Asia-Pacific workspace that is a message bus in the United States. For a European workspace it is a European one: since August 2026 the event is carried and stored in Frankfurt and consumed by our dashboard service in Europe. For a Canadian workspace it is a Canadian one: since September 2026 the event is carried and stored in Montreal and consumed by our dashboard service in Canada.

What is still United States for a European workspace is the moment the event is created for a call that ARRIVES over the phone network on a number issued through Twilio, because such a call reaches us on United States infrastructure and the systems that generate its events run there. The description of such a call is therefore written in the United States and then stays in Europe.

Since August 2026 a call arriving on a European number has its events written in Frankfurt instead, because the systems that answer those numbers run there. An outbound call we place for a European workspace moved as well, in August 2026: it is originated from Frankfurt, so its events are written in Frankfurt as well as carried and stored there.

The same split applies to a Canadian workspace, and the line falls on the carrier rather than the country. Since September 2026 a call we place, and a call arriving on a Canadian number we issue through Telnyx, both run on our Montreal machine, so their events are written in Montreal as well as carried and stored there. A call arriving on a number issued through Twilio, Canadian or United States, is answered in the United States and its event is written there before it is carried to Canada and stored.

The fourth is your inbox. When a message reaches you or goes out, we push a routing event to the same message bus so the inbox updates without waiting; it carries the other party's phone number or email address and nothing of what was written. It follows the same split as the call telemetry above, with one difference worth stating rather than glossing: those events are created by whichever of our origins served the request.

So for a European workspace they are created in Europe whenever our European origin answered, and in the United States when the geographic router sent you to ours there. Either way they are carried and stored on the European bus. A Canadian workspace works the same way, and has since September 2026: created in Montreal whenever our Canadian origin answered and in the United States when the router sent you elsewhere, and carried and stored on the Canadian bus either way.

The fifth is number registration documents, and it has applied since August 2026. When you register for a telephone number in a country whose regulator requires documents, the copy we hold is stored in a bucket in your workspace's own region, and nowhere else. Those documents are a business registry extract, a proof of address, or for a registration in an individual's name a government identity document such as a passport.

Submitting the registration then sends those documents to the carrier for the number, Twilio, whose registration service runs in the United States, because handing them to the regulator's process is the entire purpose of collecting them. Nothing is sent until you submit. They are deleted 30 days after the number is released or the registration is withdrawn, and with your account when it is deleted.

Separately from those five, and not a category of workspace content at all, there is the shared operational state that keeps the service running. Rate limits, short-lived caches, webhook idempotency claims and the lock that decides which of our origins runs a scheduled job live in one shared database in the United States, which every region touches on every request, Europe included. A second database in Frankfurt holds the rate-limit counters for requests reaching our European origin, a third in Montreal holds them for our Canadian origin since September 2026, and requests to our Asia-Pacific origin use the United States one.

None of it holds call audio, transcripts, message content or contact records, and where a key name would otherwise contain an email address, a phone number or an IP address it carries a one-way hash of that value instead. We are listing it because it is a United States database touched by every European request, not because of what is in it.

Beyond those five, and gathered here so that a Canadian reader does not have to assemble it from the table above, this is everything that still leaves Canada for a Canadian workspace. Sign-in, the directory that routes a telephone number to a workspace, the record of who belongs to your workspace, and your subscription and payment records are held in the United States, in our coordination database and at Stripe. The shared operational state described in the paragraph above is a United States database that every Canadian request touches, and a scheduled job that sweeps all four regions runs on whichever of our origins holds the lock for it, which is often the United States one.

Our sites are reached through Cloudflare's global edge, so the encrypted connection from a browser ends at whichever Cloudflare location is nearest the visitor, normally one in Canada but never guaranteed to be. Cloudflare's paid option for confining that processing to a chosen country is one we do not subscribe to for Canada. Error diagnostics go to Sentry in Germany, and infrastructure telemetry and logs to New Relic in the European Union, for all four of our regions rather than one provider region for each of ours, because neither company operates a Canadian one.

Account, verification and newsletter email is delivered from the United States by Postmark. The key that encrypts the third-party credentials you connect to your workspace, and the store that holds our own secrets, are managed by Google Cloud in a global location rather than a Canadian one, so those credentials are unwrapped against a key that is not held in Canada. The optional video avatar is rendered in the United States. A push notification that wakes your phone is delivered by the mobile platform's messaging service from outside Canada, carrying identifiers only, so the app fetches what it needs afterwards under its own credential.

A text message on a Canadian number we issue is carried through Telnyx's United States messaging interface, even where a call on that same number is answered in Montreal.

The encrypted copy of your workspace's database that we keep as a backup is written to a Cloudflare bucket whose location Cloudflare chooses rather than one pinned to Canada; it is encrypted in Montreal before it leaves and the key does not travel with it. If you turn on lead enrichment, the lookups run against United States data providers and only the result comes back to Montreal. A workspace that chooses the realtime voice engine has its calls reasoned in the United States, because Google does not serve that engine's model from Montreal.

None of this is accidental: each of these is a choice we have made, and we would rather name them in one place than leave you to infer them from eighteen rows.