Data residency

The data stays where you choose. Only a fingerprint goes public. Each customer gets a dedicated deployment in a region.

Stays in your region our statement	Leaves, only when you choose
Files placed local or held	Files placed on Walrus: a network spanning many regions. Encrypted first, but the ciphertext isn’t resident
Files in a bucket archiving within your region	Receipts on Sui: a fingerprint and version history, never content verifiable
The deployment’s metadata, failover copy and backups
Encryption keys, or your own key service wherever you run it

Choose per file or per bucket default. For small or predictable files, use a salted fingerprint so the public record can’t confirm a guess.

Archiving within your region

Archive to S3-compatible storage in your region instead of Walrus: our cold store there, or a bucket you own. Backends are set up with onboarding, each with its region and owner (ours or yours). A bucket picks one at creation, as archive_backend in its retention policy, and keeps it.

• Your key service is required. The bucket’s default encryption must be your key service before its first write; until then writes are refused with a message naming what’s missing. The archive only ever holds ciphertext.
• No Walrus copy, no per-file receipt. The public ledger still records every write, read, delete and move. witnessed
• Reads work as for any archived file. GET serves it, ranges included. HEAD names the backend in x-amz-meta-permafrost-backend.
• Deleting a file deletes its archive copy. our statement
• Agent spaces can’t use one.

Read the declaration

Anyone can ask a deployment, with no credential, where it says its data lives, which operator signs its deletion certificates, and where its public ledger is on Sui.

The declaration states where data should be our statement. A warranty region claim witnesses it for named files witnessed: the deployment signs where every copy of every file is, any copy outside the region refuses the claim, and a copy that later moves out is recorded on the warranty.

Today

Deployments run in the United States. Another region is set up on request, with standby, backups and keys there. Residency describes where things are placed, not a legal determination; ask your counsel how it applies to you.