Security
Data regions
As of 20 October 2026. This page may change as the service changes.
Each Scopebond workspace has a region, set when the workspace is created. What the workspace's agents and computers produce is stored in that region. What belongs to a person, such as their sign-in and billing, is held centrally for every workspace, because one person can belong to workspaces in both regions.
Choose a US or EU region for each workspace when you create it. A workspace keeps its region for its whole life.
Stored in the workspace's region
| Region | What is stored there | Where |
|---|---|---|
| United States | Agents, computers, rules, evidence and backups | Storage in the United States; requests are handled at the nearest Cloudflare data centre |
| European Union | Agents, computers, rules, evidence and backups | Storage in the European Union; requests are handled at the nearest Cloudflare data centre |
Held or processed centrally, for every workspace
| What | Where |
|---|---|
| The directory: your sign-in, your workspace memberships and the link to your billing account | United States (Cloudflare); for an EU workspace, protected by the EU Standard Contractual Clauses |
| Sign-in with Google, GitHub or Microsoft, if you use it, and texted sign-in codes (Google Firebase) | United States |
| Billing, invoices and tax (Stripe) | United States |
| Email about your own account, such as sign-in codes and account notices (Resend) | United States |
| Error reports (Sentry), with email addresses, tokens and home folders removed | European Union (Germany) |
| Product analytics (PostHog), with no cookies and no IP address | European Union (Frankfurt, Germany) |
| Service logs (Cloudflare Workers Logs): request paths without their query strings, status codes, counts and references, with record contents and email addresses removed; kept 7 days | Cloudflare's network |
Providers by region
United States
Your sign-in, workspace membership and billing link are held in our United States directory.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare | Hosting and storage | Storage in the United States; requests are handled at the nearest Cloudflare data centre |
| Stripe | Billing | United States |
| Resend | Email notifications | United States |
| PostHog | Product analytics | European Union (Frankfurt, Germany), through Scopebond's own address |
| Sentry | Error reports | European Union (Germany) |
| Sign-in with Google, if you use it; phone verification (Firebase) when you add a mobile number or sign in with a texted code | United States | |
| GitHub | Sign-in with GitHub, and your repository list if you connect it; Safe Install reads GitHub's public malware advisories and a public list of popular npm packages (no workspace or personal data) | United States |
| Microsoft | Sign-in with Microsoft, if you use it | United States |
| Microsoft Azure | Uptime checks of our public addresses from outside Cloudflare, and alerts to the Scopebond team when something breaks (the kind of failure and a reference only; no workspace data) | United States |
| Better Stack | Uptime checks of our public addresses and our scheduled jobs, and alerts to the Scopebond team when something breaks (the kind of failure and a reference only; no workspace data) | Checks run from several countries |
| OSV | Known advisories and malware reports for the public packages your agents install (package names and versions only; no workspace or personal data) | United States |
| npm | Publish dates, downloads and install scripts of the public npm packages your agents install (package names only; no workspace or personal data) | United States |
| PyPI | Publish dates and downloads of the public Python packages your agents install (package names only; no workspace or personal data) | United States |
| Open Source Insights (deps.dev) | Publish dates of public package versions your agents install (package names and versions only; no workspace or personal data) | United States |
| Top PyPI Packages | A public list of popular Python packages, for Safe Install's typo-squat check (nothing is sent) | Served from GitHub Pages |
European Union
Your sign-in, workspace membership and billing link are held in our United States directory, protected by the EU Standard Contractual Clauses.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare | Hosting and storage | Storage in the European Union; requests are handled at the nearest Cloudflare data centre |
| Stripe | Billing | United States |
| Resend | Workspace email (invitations, alerts, reports) | European Union (Ireland); email about your own account is sent from the United States |
| PostHog | Product analytics | European Union (Frankfurt, Germany), through Scopebond's own address |
| Sentry | Error reports | European Union (Germany) |
| Sign-in with Google, if you use it; phone verification (Firebase) when you add a mobile number or sign in with a texted code | United States | |
| GitHub | Sign-in with GitHub, and your repository list if you connect it; Safe Install reads GitHub's public malware advisories and a public list of popular npm packages (no workspace or personal data) | United States |
| Microsoft | Sign-in with Microsoft, if you use it | United States |
| Microsoft Azure | Uptime checks of our public addresses from outside Cloudflare, and alerts to the Scopebond team when something breaks (the kind of failure and a reference only; no workspace data) | United States |
| Better Stack | Uptime checks of our public addresses and our scheduled jobs, and alerts to the Scopebond team when something breaks (the kind of failure and a reference only; no workspace data) | Checks run from several countries |
| OSV | Known advisories and malware reports for the public packages your agents install (package names and versions only; no workspace or personal data) | United States |
| npm | Publish dates, downloads and install scripts of the public npm packages your agents install (package names only; no workspace or personal data) | United States |
| PyPI | Publish dates and downloads of the public Python packages your agents install (package names only; no workspace or personal data) | United States |
| Open Source Insights (deps.dev) | Publish dates of public package versions your agents install (package names and versions only; no workspace or personal data) | United States |
| Top PyPI Packages | A public list of popular Python packages, for Safe Install's typo-squat check (nothing is sent) | Served from GitHub Pages |
The subprocessor list names each provider's company and what data it receives, and the Data Processing Agreement sets the terms for your workspace's data.