Can we keep EU data in the EU?
- Date
- By
- CipherStash Team
Yes, if your application runs in the EU as well. A workspace is bound to one ZeroKMS region, and Frankfurt and Ireland are on the list. Encryption and decryption run in your infrastructure, ciphertext stays in your database, and the authority key never leaves the workspace's region. Deploy your application in the EU too and all key material stays there. Data encrypted in an EU workspace cannot be decrypted with credentials from another region.
ZeroKMS runs on AWS only, in seven regions. If you need key management in a region that is not on the list, the answer today is to ask support, not to assume. Here is the list: Sydney, Frankfurt, Ireland, Northern Virginia, Ohio, Northern California, Oregon.
What stays where
Three properties do the work. Plaintext never leaves your systems, because encryption and decryption run in the SDK or Proxy inside your infrastructure. Ciphertext never leaves your systems either, because it lives in your database. Data keys are never transmitted, because they are derived locally from a key seed and your client key.
A workspace is tied to one region, and the region is part of the workspace identifier. Choosing an EU region means the authority keys are managed there. Deploying your application there means the client key and every derived data key exist there too. Together that is the whole set of key material.
Two regions, two boundaries
For a business with EU and non-EU customers, the documented pattern is a workspace per region, each with its own authority keys, its own client key and its own database. Data encrypted in the EU workspace cannot be decrypted by the application in the other region. The boundary is enforced by the keys: an application in the other region cannot decrypt EU data, however its database access is set up. What remains is configuration you control: which clients you grant to the EU workspace, and where you run the application that holds its client key.
A global team that needs cross-border access gets a client per region with that region's credentials. Revoking one person's access to EU data means deleting their client in the EU workspace, and every derivation they did is in that workspace's audit record.
What this does and does not settle
The docs say the single-region pattern "satisfies most data residency requirements, including GDPR and regional data protection laws." The compliance page says in the same breath that these controls "do not by themselves make a workload compliant." Both are true. The architecture gives you a residency boundary you can demonstrate. Whether your regulator or your customer's counsel accepts encrypted data outside the region with keys inside it is their call, and you should ask them before you design around it.