Data residency, erasure and export

RegionsCopy Anchor Link

Every region runs the same software on in-country infrastructure. A region opens only after its own readiness checklist: in-country compute and storage, its model-processing policy for Ask, and legal review. Pakistan is pending a cloud-policy review.

What stays in the regionCopy Anchor Link

A project's region is chosen when it is created and cannot be changed. Everything about your end users is stored and processed only in that region:

• events, persons and the identity graph;
• session recordings (object storage in the same region);
• cohort memberships;
• AI conversations and answers, which are produced in the region;
• revenue events.

The control plane (accounts, billing, project settings, and definitions such as insights, flags and experiments) is global. It stores configuration and aggregates, not your end users' data. Queries go from your browser or API client straight to the region with a short-lived token, so results do not pass through the control plane.

There is no global ingest proxy. SDKs send to the region named in the project key.

What is never storedCopy Anchor Link

• IP addresses. Ingest resolves the location and drops the address. The public web servers keep no access logs for ingest, for the same reason.
• Masked replay content. Masking happens on the device; masked text never leaves it.
• Secrets in URLs. The web SDK redacts sensitive query parameters before a URL leaves the page.

ErasureCopy Anchor Link

Erase a person (or any set of distinct ids) with one request. The deletion runs in the project's region and ends with a signed certificate that anyone can verify.

The certificate records whether each commitment was met (invisible_met, purged_met) and when the last backup containing the data expires.

Request an erasureCopy Anchor Link

Requests need a token with the named persons.erase scope. Only organisation admins and owners hold it, and no other scope implies it.

curl -X POST "https://app.analytics.atrix.dev/v1/projects/$PROJECT_ID/erasure-requests" \
  -H "Authorization: Bearer $ATRIX_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{ "distinct_ids": ["user_42", "0190f2a4-5b6c-7d8e-9f01-23456789abcd"], "reason": "GDPR Art. 17 request, ticket 1182" }'

Send distinct_ids (up to 1,000), a person_id, or both. The answer is 202 with the request: its status, current phase, the timestamp of each phase, and sla_due_at (72 hours after the request). The control plane stores only salted hashes of the identifiers; the raw ids go straight to the region.

The certificateCopy Anchor Link

A completed request has a certificate signed with Ed25519. It contains the request and project, the hashed subjects, the time of every phase, whether each commitment was met, per-store deletion counts, the backup expiry date, and the signing key id. Identifiers never appear in it: subjects are sha256("atrix-erasure-v1" · 0x00 · project_id · 0x00 · identifier), so you can prove a given id was erased without the certificate revealing who it was.

Anyone holding a certificate can check it, with no credentials:

curl -X POST https://app.analytics.atrix.dev/v1/erasure-certificates/verify \
  -H 'Content-Type: application/json' \
  -d @certificate.json          # { "certificate": {...}, "signature": "..." } as downloaded

The answer is { "valid": true, "issued_by_this_service": true, "request_id": "…", "issued_at": "…" }. The public keys are at GET /v1/erasure-certificates/keys for verifying offline.

Erasure is API-only for now; a console screen is Planned.

ExportCopy Anchor Link

Stream your raw events (and, optionally, daily person snapshots) to your own S3-compatible bucket as Parquet. Exports run in the project's region, straight to your bucket.

• Format: Parquet with zstd, hive-style partitions: events/date=YYYY-MM-DD/hour=HH/…parquet, plus a JSON manifest per window.
• Windows of 15 minutes to a day (60 minutes by default), each written exactly once and deduplicated on the event uuid. Erased people are excluded. backfill_from exports history.
• Destinations are managed on the region API with a region token carrying the named export scope: POST /exports/destinations, GET /exports/destinations, DELETE /exports/destinations/{id}, and GET /exports/destinations/{id}/runs. Secret keys are encrypted and never returned; endpoints must be HTTPS.

curl -X POST https://eu.api.analytics.atrix.dev/exports/destinations \
  -H "Authorization: Bearer $REGION_TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "warehouse",
    "endpoint": "https://s3.eu-central-1.amazonaws.com",
    "region": "eu-central-1",
    "bucket": "acme-analytics",
    "prefix": "atrix/",
    "path_style": false,
    "window_minutes": 60,
    "include_persons": true,
    "access_key_id": "AKIA…",
    "secret_access_key": "…"
  }'

Iceberg table commits are Planned; the file layout is ready for an Iceberg add_files or a Glue crawler. There is no console screen for exports yet.

RetentionCopy Anchor Link

Plans include 1 year (Free) up to 7 years (Scale) of retention. Expired data is removed automatically, recordings included, by storage-level time-to-live rules.