Compliance

Your data, your region

Pick where candidate resumes and analysis results are stored at signup. Four regions, no cross-region fallbacks, residency enforced at the infrastructure layer.
Last updated: April 21, 2026
GetPruf runs in four isolated regions. Each tenant picks exactly one region when the account is created, and that choice is immutable after the first resume upload. We never copy, replicate, or fall back to another region - if the chosen region is degraded, the tenant's uploads fail closed rather than silently shifting jurisdictions.

Supported regions

United States
aws-us-east-1 - AWS S3, us-east-1 (N. Virginia)
Compliance: General-purpose region. No jurisdiction-specific certification required.
When to pick: Default for US-based teams. Pick this if you have no regulatory requirement to choose something else.
Canada (PIPEDA)
aws-ca-central-1 - AWS S3, ca-central-1 (Montreal)
Compliance: Personal Information Protection and Electronic Documents Act (PIPEDA).
When to pick: Required for Canadian federal and most provincial sector obligations where candidate data must remain in Canada.
European Union (GDPR, EU AI Act)
aws-eu-central-1 - AWS S3, eu-central-1 (Frankfurt)
Compliance: GDPR Article 28 (processor), Standard Contractual Clauses, EU AI Act high-risk system documentation (by 2 August 2026).
When to pick: Required for processing EU/EEA candidate data. EU residency stops international transfers and simplifies Article 45/46 obligations.
Russia (152-Π€Π—)
yandex-ru-central1 - Yandex Object Storage, ru-central1
Compliance: Federal Law 152-FZ on personal data localization. Operator-of-personal-data registry notice on file.
When to pick: Required when processing personal data of citizens of the Russian Federation. Data stays on infrastructure physically located in Russia.

What residency guarantees

  • Resume uploads, analysis results, and PDF reports are written only to the region selected at signup. The storage bucket is physically located in that region and is not cross-region replicated.
  • The residency choice is immutable after the first resume upload. Changing regions requires a manual data migration which purges the source region.
  • Sub-processor list and data flows for each region are documented in the Data Processing Agreement. Russian tenants use a sub-processor list separate from the three AWS regions.
  • Access to production data is restricted per region. GetPruf staff outside the region cannot read stored tenant data in that region without an explicit break-glass audit trail.

Cross-border teams

If your candidate pool spans multiple jurisdictions, create separate GetPruf accounts, each bound to the correct region for that pool. One organization can operate multiple accounts, each with its own residency and billing, linked via our Enterprise plan. Talk to sales for details.

Documentation

GDPR EU AI Act PIPEDA 152-Π€Π—
Full sub-processor list, cross-border transfer clauses, and data subject rights are in the Data Processing Agreement. Privacy and retention terms are in the Privacy Policy. EU AI Act high-risk system documentation is tracked at /ai-act.

Questions

For questions about residency, sub-processors, or compliance documentation contact privacy@getpruf.ai.