Meet your data residency requirements

Private preview

This feature is in Private preview and subject to change. It is available only on multi-tenant SaaS.

If your organization has legal, regulatory, or policy requirements that define where security assessment data is stored, you can use XBOW in a data residency region. XBOW stores your security-sensitive data in the region you choose.

Your options

Standard platform: Your data is stored in the United States at console.xbow.com. This is the default for all customers.
Data residency region: Your data is stored in Australia, Canada, Europe, Japan, or Singapore. Each region is a separate deployment with its own URLs.

For the regions, their locations, and their URLs, see Available regions. For exactly which data is stored in your region and which is managed globally, see Data storage and processing.

Choose a region

Each organization uses one region, chosen when you start using XBOW. You cannot switch an organization to a different region, and XBOW does not migrate data between regions.

If you need a different region, contact the XBOW sales team to set up a new organization there. Existing assessments, findings, and reports will stay in the original organization.

If you operate in several geographies with different requirements, talk to the XBOW sales team about your options.

Get started

Identify the region your data must stay in.
Contact the XBOW sales team to confirm the availability of your region and provision your organization.
Onboard your company at your regional Console URL.

What changes

URLs: You sign in and call the API at your region’s URLs. See Available regions.
API keys and webhooks: These are specific to a region. A key from one region works only against that region’s API, so check the endpoint in any integration or CI/CD pipeline. Using the wrong endpoint causes authentication errors.
Single sign-on: Configure SSO separately for each region. See Set up single sign-on authentication.
IP allowlisting: Each region uses its own IP addresses for assessments. See Access requirements.
Support tickets: Refer to assets, assessments, and findings by ID rather than including sensitive security details. See Operational data and security monitoring.

You use Console and the API in the same way to create assets, run assessments, and review findings.

Limitations

Data residency controls where XBOW stores your data. For the full limits, see Limitations.

AI models: Only Europe currently keeps AI model processing in region. If your policies require model processing to stay in a region, contact the XBOW sales team before you start.
Staff access: Authorized XBOW staff may access data in your region from outside it to provide support.
Jurisdiction: XBOW is subject to US legal jurisdiction, so data residency does not provide absolute data sovereignty. If you need to run the platform entirely in your own environment, contact the XBOW sales team about self-hosted deployment.
Global operational data: Billing, support, telemetry, and security monitoring data are managed globally.

How data residency supports compliance

Data residency helps you meet requirements for where security assessment data is stored. It does not make your organization compliant by itself.

Requirement	How data residency helps
GDPR	When you use the Europe region, security assessment data is stored in the EU, which can reduce the cross-border transfers you need to manage.
Data sovereignty requirements	Your security-sensitive data is stored in the jurisdiction you choose, so you can show where it is kept.
Your own security and privacy frameworks	You can document that security assessment data is stored in a region you control, to support your data location policies.

For XBOW’s own certifications, see Trusting XBOW to assess your asset and the Trust Center.