Data Residency and International Transfers

1. Our Approach

elyXion prefers European hosting and processing for elyXion -controlled production services where practical. “European hosting” does not automatically mean every support, telemetry, identity, backup, vendor, or remote-access activity remains exclusively in the EU.

This statement must be reconciled with deployed architecture and provider contracts before publication.

2. Service-specific Location

Service/data set	Primary location	Backup/DR location	Potential remote access	Notes
Public website	[REGION/PROVIDER]	[REGION]	[COUNTRIES]	Confirm CDN and logs
elyXion Portaal	[REGION/PROVIDER]	[REGION]	[COUNTRIES]	Confirm identity, telemetry, email
Support platform	[REGION/PROVIDER]	[REGION]	[COUNTRIES]	Confirm attachments and integrations
Customer Microsoft environment	Customer-selected Microsoft geography	Per Customer configuration	Per tenant/provider configuration	Customer-controlled
Source control and CI/CD	[PROVIDER/REGION]	Provider-controlled	Provider support locations	Avoid production secrets/data

3. Customer-controlled Microsoft Services

For Customer Azure and Microsoft 365 tenants, the Customer selects eligible geography and configuration under Microsoft terms. elyXion‘s access does not change ownership of the tenant. Some Microsoft services process global operational or support data as described in Microsoft documentation and contracts.

4. Transfers Outside the EEA

Where a restricted transfer occurs, elyXion uses a lawful mechanism such as an adequacy decision, Standard Contractual Clauses, or another permitted safeguard. elyXion considers the nature of data, destination law, provider practices, encryption, access control, and available supplementary measures.

5. Remote Support

Access by personnel located outside the EEA is disabled by default unless operationally used and contractually authorised. If introduced, it must be recorded in the subprocessor and transfer assessment.

6. Customer Options

Where supported, Customers may request specific regions, customer-managed encryption keys, restricted administrative access, or dedicated architecture. These may affect price, functionality, support, or resilience and must be agreed in the Order Form.

7. Data Minimisation

elyXion seeks to avoid copying production Customer Data into support, development, or analytics environments. Diagnostic collection should be limited to what is necessary, securely transferred, access-controlled, and deleted according to purpose.

8. Changes

Cloud providers may add regions or change service architecture. Material residency changes affecting a contracted commitment will be handled through the Agreement and subprocessor notice process.