Data residency and compliance by region

Data location is a contract and architecture question, not a slogan. This guide sets out what we can say today, region by region, so you can ask the right questions. It is not legal advice, and your Order Form, DPA and BAA are the binding documents.

How region is decided

The Azure region for production is chosen per customer and stated in the Order Form. The public demonstration environment runs in Central India. Which region applies, and what processes data there, depends on your plan:

• Starter and Professional run on a shared SKIFIN-operated host. Each tenant has a logically separate database and storage; Professional can have a dedicated database account. Compute is shared.
• Private is deployed in your own Azure subscription, so you choose the region and can use your own AI resources.
• Enterprise is a managed dedicated environment operated by SKIFIN in your Azure subscription.

Data at rest versus AI processing

Two things are easy to conflate. Data at rest is where documents, extracted fields and logs are stored. AI processing is where document text is sent for extraction, classification, summaries, chat and OCR. Models run on Microsoft Azure, including Azure OpenAI and a Mistral OCR model deployed on Azure AI Foundry, and not on the providers’ own services.

On the shared host, the AI endpoint is configured globally today. A tenant’s data may be stored in one place while AI requests go to the host’s configured endpoint. Per-tenant AI routing is not yet available on the shared host. For stronger control, Private and Enterprise deployments can place AI resources in a region you specify, and Private offers a bring-your-own-AI option.

Global and United States

Healthcare customers typically need a BAA. Droqify supports HIPAA-regulated workloads under a signed BAA on eligible plans; we do not claim that using Droqify by itself satisfies HIPAA. Starter is not for protected health information. GDPR and UK GDPR customers can request a DPA, which includes standard contractual clauses and the UK addendum.

India

SKIFIN is based in India. We are aligned with and preparing for the DPDP Act, 2023 and the DPDP Rules, 2025, whose core duties apply from 13 May 2027, and we operate in line with IT Act section 43A and the SPDI Rules and the CERT-In Directions 2022. Customers with an Indian billing address are invoiced in INR plus GST.

UAE and the GCC

Region is again set in the Order Form. Residency or sovereignty requirements in the Gulf are usually best met with a Private or Enterprise deployment in a region and subscription you control. Raise any sector-specific requirement before signing so we can confirm what is feasible.

Canada (early access)

Canada is at an early stage. Azure services such as databases, storage and queues can be deployed in Canadian regions, and a Private deployment in your Canadian subscription is the stronger option. End-to-end Canadian residency is not available yet. The production model and OCR path we use are not offered with guaranteed in-Canada processing, and shared-host AI routing is global. We will not claim data stays in Canada until that is resolved. If you evaluate us, ask for the current position in writing.

Compliance status

Encryption uses Microsoft-managed keys by default, and customer-managed keys are available on Private and Enterprise. We do not train models on customer data. See the Security, Privacy and Subprocessors pages for the current detail.

Questions to ask any vendor

Where is data stored, and where is it processed by AI? Who are the subprocessors? What happens at termination? Ask for each answer in the contract, not only on a web page.