01
Primary systems
Production policy places service compute, the authoritative database, and customer file storage in the approved Frankfurt primary region, subject to release verification.
Data residency & transfers
EU-region policy, with transfers on the record.
Product policy selects Frankfurt as the primary region for production customer-data resources. A release must separately document backups, operational access, service providers, and every applicable international transfer path.
The ActLume data map
What runs where.
Before production use, release documentation must cover the whole path customer data can take: primary systems, operational copies, human access, and service providers.
02
Operational copies
Release documentation must identify backups, recovery material, logs, and exports by category and location.
03
Human access
Support, administration, and incident-response access must be role-limited, attributable, and origin-documented.
04
Service providers
Every processor able to receive or reach customer data must be named with its purpose before the corresponding production path is approved.
Transfer transparency
One disclosure covers the whole path.
A production residency statement must be checkable against systems, regions, access paths, recipients, safeguards, and exceptions for each customer-data category.
Documented location and scope
- the named production region for each customer-data service;
- backup, log, and disaster-recovery locations;
- the data categories each statement covers;
- exceptions and operational access paths.
Documented transfers
- processors and subprocessors, with their purpose;
- support and administrative access paths;
- the applicable transfer mechanism and safeguards;
- the change-notification and review process.
For your compliance review
Straight answers to the questions your reviewers will ask.
01 Which data and which service does the residency statement cover? Release documentation must name each customer-data service and the data categories it covers, so the statement's scope is explicit.
02 Where are backups, logs, exports, and recovery copies kept? Release evidence must locate operational copies by category rather than treating the primary-region policy as proof of every storage path.
03 Can support or provider personnel reach the data from another country? Operational access paths must identify where they can originate. EU-region hosting must never be presented as "no international processing".
04 Which subprocessors receive data, and for what purpose? Each processor able to receive or reach customer data must be named with its purpose in the release documentation.
05 What transfer mechanism applies, and how is it reviewed? The applicable safeguard must be identified for each transfer path and kept under review.
06 How are customers told when the data map changes? An approved change-notification and review process must cover changes to providers, regions, and access paths.
Keep reviewing