Data protection
Where your data is processed, who can reach it, and which providers are involved.
Last updated: 2 October 2026.
A factual summary, checkable against the security model, the DPA and the privacy notice. It is not legal advice.
At a glance
- Briqs, volumes and logs stay in your team's region: Paris by default.
- One Firecracker microVM per briq, one private network per team.
- Secret values are write-only and masked everywhere.
- A DPA that applies without signature, with 30 days' notice of sub-processor changes.
briq holds no GDPR certification, and does not claim to be "GDPR compliant": the GDPR is a regulation, not a standard you pass, and Article 42 certifications cover a named processing operation, not a company.
Where your data is
| Data | Where | Kept |
|---|---|---|
| Briqs (microVM, memory, root filesystem) | Your team's region | Until the briq is destroyed |
| Volumes | Same region | Until the volume is destroyed |
Logs readable through briq_logs | Same region | Until the briq is destroyed |
| Account, teams, keys, briq metadata, audit | Amsterdam, Netherlands | See the privacy notice |
A team picks its region: Paris (default), Virginia or Singapore. Only Paris is in the EU; the dashboard says so next to the setting. See regions.
Jurisdiction
Residency and jurisdiction differ. Our providers run EU sites and have data processing agreements with us, but their parent companies are incorporated in the United States. A US order such as one under the CLOUD Act can in principle reach them whichever region holds the data. An EU region reduces that exposure; it does not remove it. If you need an EU-incorporated provider, briq does not meet that requirement today.
Roles
| Data | briq is | You are |
|---|---|---|
| Your account: name, email, sessions, teams, billing | Controller (privacy notice) | The data subject |
| Whatever your agents put inside a briq | Processor (DPA) | Controller |
briq does not read, index or train on what is inside your briqs.
Providers
| Provider | Role | Where | Handles data inside briqs |
|---|---|---|---|
| Infrastructure provider | Runs briqs: compute, volumes, logs | Your team's region | Yes (DPA sub-processor) |
| Hosting provider | Runs the control plane: API, dashboard, database | Amsterdam | Metadata only (DPA sub-processor) |
| Email delivery provider | Sends service email | United States | No |
| Analytics provider | Audience measurement | Frankfurt | No |
All are US-parented and bound by data processing agreements. We name each on request: privacy@briq.cloud.
What is in place
| Document or process | Status |
|---|---|
| Privacy notice and cookies (Arts. 13–14, ePrivacy) | Published |
| Data processing agreement (Art. 28) | Published, part of the terms |
| Terms of service | Published |
| Record of processing (Art. 30) | Internal |
| Data subject requests (Arts. 15–22) | Written procedure, handled by hand |
| Breach procedure (Arts. 33–34) | Written procedure |
Contact
Data requests: privacy@briq.cloud. Security reports: security@briq.cloud, see responsible disclosure. You can also complain to the CNIL.