EU Data Sovereignty

FoundryDB is a European platform built on European infrastructure. Your data is stored, processed, and backed up exclusively within the European Union. There is no dependency on US hyperscalers.

Data Residency

All customer data remains within EU/EEA data centers at every layer:

Layer	Location	Details
Database storage	EU data center selected at creation	Live data on encrypted block storage
Backups	EU object storage	AES-256-GCM encrypted before upload
Write-ahead logs	Same zone as the database VM	Streamed to EU object storage for PITR
Metadata	EU (Helsinki)	Service configuration, credentials, audit logs
DNS	EU anycast	Service domains resolve to EU endpoints

Data never leaves the EU. There is no cross-region replication to non-EU zones unless you explicitly configure it.

Infrastructure Provider

FoundryDB runs on UpCloud, a cloud infrastructure provider headquartered in Helsinki, Finland. UpCloud is a European company subject to EU/Finnish jurisdiction.

Key differences from US-based hyperscalers:

Aspect	FoundryDB on UpCloud	US Hyperscalers
Corporate jurisdiction	Finland (EU)	United States
CLOUD Act exposure	No	Yes
Data center ownership	UpCloud-operated EU facilities	Global, including non-EU
Billing entity	European	Typically US-based

UpCloud operates its own data centers across Europe with full control over the physical infrastructure, networking, and storage hardware.

Available EU Regions

Deploy your databases in any of the following European zones:

Zone	City	Country
fi-hel1	Helsinki	Finland
se-sto1	Stockholm	Sweden
de-fra1	Frankfurt	Germany
nl-ams1	Amsterdam	Netherlands
uk-lon1	London	United Kingdom
es-mad1	Madrid	Spain
pl-waw1	Warsaw	Poland

Select a zone when creating a service:

curl -u user:password -X POST https://api.foundrydb.com/managed-services \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-database",
    "database_type": "postgresql",
    "version": "17",
    "plan_name": "tier-2",
    "zone": "de-fra1",
    "storage_size_gb": 50,
    "storage_tier": "maxiops"
  }'

Multi-node deployments (read replicas, standby nodes) can span multiple EU zones for geographic redundancy while keeping all data within the EU.

GDPR Compliance

FoundryDB is designed to support your GDPR obligations as a data processor.

Data Processing

• FoundryDB acts as a data processor under GDPR Article 28. You remain the data controller.
• Processing is limited to operating and maintaining your database services. FoundryDB does not access, analyze, or use the contents of your databases for any other purpose.
• A Data Processing Agreement (DPA) is available on request.

Data Subject Rights

Your databases are under your full control. You can fulfill data subject requests (access, rectification, erasure, portability) directly through your database connections. FoundryDB does not restrict or interfere with these operations.

Data Retention

• Database data persists until you delete it or terminate the service.
• Backups follow the retention policy you configure (default: 7 days for automated backups).
• When a service is deleted, all associated data, backups, and encryption keys are permanently destroyed.

Breach Notification

FoundryDB will notify affected customers within 72 hours of confirming a personal data breach, in accordance with GDPR Article 33.

Encryption

All data is encrypted at rest and in transit. See TLS & Encryption for full details.

Layer	Method
In transit	TLS 1.2/1.3 on all database connections and API calls
Storage volumes	AES-256 block-level encryption at the infrastructure layer
Backups	AES-256-GCM with per-backup unique keys
Credentials	AES-256-GCM with keys derived via PBKDF2 (SHA-256, 100k iterations)

Encryption keys are managed within the EU. No key material is transmitted outside EU infrastructure.

Access Controls

FoundryDB enforces strict boundaries around customer data:

• No human access to database contents. FoundryDB staff cannot read, query, or export data from your databases. All database operations are performed by automated systems (the agent running on your VM).
• Infrastructure access is limited to automated provisioning, monitoring, and maintenance tasks. These systems interact with VM-level operations (start, stop, resize, backup) and never access database contents.
• Audit logging records all API actions with timestamp, actor, and source IP.
• IP allowlisting restricts database connections to your explicitly approved CIDR ranges. New services reject all inbound connections by default.
• Dedicated VMs. Each service runs on its own virtual machine. There is no shared compute or storage between customers.

Certifications and Standards

UpCloud, the infrastructure provider, maintains the following certifications:

Certification	Scope
ISO 27001	Information security management across all data centers
SOC 2 Type II	Security, availability, and confidentiality controls
ISO 9001	Quality management
ISO 14001	Environmental management
GDPR compliant	Full compliance as an infrastructure provider under EU law

UpCloud data centers comply with European physical security standards including 24/7 surveillance, biometric access controls, and redundant power and cooling.

Summary

Question	Answer
Where is my data stored?	EU data center you selected (Helsinki, Stockholm, Frankfurt, Amsterdam, London, Madrid, or Warsaw)
Can my data leave the EU?	No, unless you explicitly configure cross-region replication to a non-EU zone
Who can access my data?	Only you, through your database credentials. No FoundryDB staff access to database contents.
Is a DPA available?	Yes, on request
What encryption is used?	AES-256 at rest, AES-256-GCM for backups and credentials, TLS 1.2+ in transit
Is the infrastructure provider European?	Yes, UpCloud is headquartered in Helsinki, Finland
Is there CLOUD Act exposure?	No. UpCloud is a Finnish company under EU jurisdiction.