TRUST CENTER

Designed across four business regions on three cloud providers.

Tanqory's architecture supports multi-region, multi-cloud deployment across four business regions on DigitalOcean, Google Cloud, and Amazon Web Services, fronted globally by Cloudflare. Workloads are provisioned per the merchant's business region. Multi-region active-active failover is not currently in production; cross-region failover is on the resilience roadmap.

Email the Trust teamView subprocessors

Regional deployment footprint

The table below mirrors our internal `03-infrastructure.yaml` source of truth. Cells show the cloud regions used in each business region; an em-dash means the cloud is not in scope for that business region.

Business regionDigitalOceanGoogle CloudAmazon Web Services
Asia Pacific
  • sgp1 (Singapore)
  • asia-southeast1 (Singapore)
  • ap-southeast-1 (Singapore)
Americas
  • nyc1 (New York)
  • sfo3 (San Francisco)
  • us-central1 (Iowa)
  • us-east1 (South Carolina)
  • us-east-1 (N. Virginia)
Europe
  • fra1 (Frankfurt)
  • ams3 (Amsterdam)
  • europe-west1 (Belgium)
  • europe-west3 (Frankfurt)
  • eu-west-1 (Ireland)
  • eu-central-1 (Frankfurt)
Middle East Africa
  • lon1 (London, used as MEA proxy)
  • me-central1 (Doha, Qatar)
  • me-south-1 (Bahrain)
  • af-south-1 (Cape Town)

Jurisdictions by business region

  • Asia Pacific

    Singapore, Malaysia, Indonesia, Philippines, Vietnam, Japan, South Korea, India, Australia, New Zealand

  • Americas

    United States, Canada, Mexico, Brazil, Argentina, Chile, Colombia

  • Europe

    European Union/EEA member states, United Kingdom, Switzerland

  • Middle East Africa

    UAE, Saudi Arabia, Qatar, South Africa, Egypt, Nigeria, Kenya

Source: infrastructure source of truth, effective 2026-05-26 (v1).

Data residency, explained

Each business region serves a defined set of merchant jurisdictions. Region-pinned customer data is not transferred outside its assigned business region except as required by an applicable legal mechanism — Standard Contractual Clauses, UK IDTA, Swiss adequacy addendum — or for operational reasons described in our Data Processing Agreement. Merchants on Enterprise plans, or with a DPA addendum, may request a different business region. Cross-region disaster-recovery copies, when used, are documented in the DPA and remain within the same legal-transfer envelope as the primary region. Where this page says a business region is 'provisioned' or 'designed for' a particular workload, that means the underlying cloud capacity exists. Production traffic for a given service is currently routed to the primary region assigned at sign-up; cross-region failover and per-workload routing rules are on the resilience roadmap. Data residency commitments are owned by the Data Protection Officer (dpo@tanqory.com).

Email the DPO(opens in a new window)

Common questions about regions and residency

Can I choose my business region?

By default, Tanqory assigns the business region that best serves your merchant location and regulatory profile. Enterprise plan customers and customers with a DPA addendum can request a specific business region; we'll confirm feasibility and any cost implications. Regional placement decisions are owned by the Data Protection Officer (dpo@tanqory.com) together with the Engineering team.

What happens during a regional failover?

Each business region has documented disaster-recovery procedures. Failover stays inside the same legal-transfer envelope as the primary region — your data is not moved to a different jurisdiction during failover. Cross-region active-active failover is not currently in production; it is on the resilience roadmap, owned by Engineering.

Is Cloudflare a separate region?

Cloudflare provides global edge, WAF, and DDoS protection in front of the origin. Edge caching is configured to respect customer-data placement rules; identifiable customer data is not retained at the edge beyond the operational TTLs documented in our Security Overview.

Where can I find the international-transfer paperwork?

Standard Contractual Clauses, the UK IDTA, the Swiss adequacy addendum, and intra-group transfer agreements are referenced from the Privacy hub and provided as part of the DPA package on request from dpo@tanqory.com. Subprocessor and transfer-mechanism reviews are owned by the Data Protection Officer together with Procurement.

Will new regions be added?

Yes. The region roadmap is sequenced against customer demand and regulatory readiness. When a new business region launches, it is added to this page on the same build cycle as the underlying YAML source of truth. The region roadmap is owned by Engineering with input from the Data Protection Officer.

Need a residency review or addendum?

Enterprise teams can request a regional placement review, our DPA template, and a residency briefing from our Trust team.

Email the Trust team