# Security & Data Residency

Aurea runs in an EU region in Italy. Every copy of your data that Aurea keeps stays in the European Union.

## Overview

- **Primary region: the EU, in Italy.** The API, the database that holds your tenant, its users, wallets, transactions and audit trail, the platform's share of every MPC signature, and the platform's operational logs all run and are stored there.
- **Everything else stays in the EU.** Database backups, the keys the platform holds, and the services the platform sends email and translations through are in EU regions.
- **Aurea does not move your data outside the EU.** Services you choose to enable process what they need under their own terms (Services You Enable).

## Where Each Part Runs

| Part of the platform | What it holds | Region |
| --- | --- | --- |
| API and database | Your tenant, its users, accounts, wallets, transactions, operations, events and audit trail | EU (Italy) |
| MPC co-signer | The platform's part of each MPC signature. It holds no complete key. | EU (Italy) |
| Operational logs | Request records: routes, tenant and request ids, client IP addresses | EU (Italy) |
| Database backups | Daily and pre-upgrade copies of the database, kept in two regions so the service can be restored if a whole region fails | EU (Italy) and a second EU region |
| Keys the platform holds | The keys of custodial wallets and the platform's share of MPC wallets, always encrypted. Keys of non-custodial wallets stay on your users' devices. | EU regions |
| Transactional email | Password resets and confirmations sent to your users | EU |
| Onboarding translations | The onboarding texts you write, translated into your users' languages (no personal data) | EU |
| Agentic payments assistant | What a user types to an agent, when your tenant uses agentic payments | EU |

## Services You Enable

Some features reach services outside the platform. They process the data each request needs under their own terms and in their own locations:

- the bank ramp, the card onramp, cards and the EUR account, swaps, Earn and lending, when your tenant has them;
- the blockchain networks your wallets use, and the nodes the platform reads them through;
- push notifications, delivered through the notification service of each user's device platform.

Data written to a public blockchain, such as addresses and transfers, is public and has no location.

## Your Tenant's Security

- The controls you can add, and which are recorded or enforced today: [Feature Availability](https://docs.aureahub.com/docs/feature-availability.md).
- Report a suspected vulnerability to [help@aureahub.com](mailto:help@aureahub.com) ([Security Overview › Reporting a Vulnerability](https://docs.aureahub.com/docs/guide-security.md)). If a credential may have leaked: [Credentials & Rotation › If a Secret Leaks](https://docs.aureahub.com/docs/guide-credentials.md).

## Changes

Changes to these regions are announced in advance.

---

Web version: https://docs.aureahub.com/#guide-data-residency