# Data protection

URL: https://briq.cloud/legal/data-protection

> Where your data is processed, who can reach it, and which providers are involved.

Last updated: 2 October 2026.

A factual summary, checkable against the [security model](https://briq.cloud/docs/security), the
[DPA](https://briq.cloud/legal/dpa) and the [privacy notice](https://briq.cloud/legal/privacy). It is not legal advice.

## At a glance

* Briqs, volumes and logs stay in your team's region: Paris by default.
* One Firecracker microVM per briq, one private network per team.
* Secret values are write-only and masked everywhere.
* A [DPA](https://briq.cloud/legal/dpa) that applies without signature, with 30 days' notice of sub-processor changes.

briq holds no GDPR certification, and does not claim to be "GDPR compliant": the GDPR is a
regulation, not a standard you pass, and Article 42 certifications cover a named processing
operation, not a company.

## Where your data is

| Data                                       | Where                  | Kept                                               |
| ------------------------------------------ | ---------------------- | -------------------------------------------------- |
| Briqs (microVM, memory, root filesystem)   | Your team's region     | Until the briq is destroyed                        |
| Volumes                                    | Same region            | Until the volume is destroyed                      |
| Logs readable through `briq_logs`          | Same region            | Until the briq is destroyed                        |
| Account, teams, keys, briq metadata, audit | Amsterdam, Netherlands | See the [privacy notice](https://briq.cloud/legal/privacy#retention) |

A team picks its region: Paris (default), Virginia or Singapore. Only Paris is in the EU; the
dashboard says so next to the setting.
See [regions](https://briq.cloud/docs/regions).

## Jurisdiction

Residency and jurisdiction differ. Our providers run EU sites and have data processing agreements
with us, but their parent companies are incorporated in the United States. A US order such as one under the CLOUD Act can in principle reach them whichever
region holds the data. An EU region reduces that exposure; it does not remove it. If you need an
EU-incorporated provider, briq does not meet that requirement today.

## Roles

| Data                                                | briq is                                       | You are          |
| --------------------------------------------------- | --------------------------------------------- | ---------------- |
| Your account: name, email, sessions, teams, billing | Controller ([privacy notice](https://briq.cloud/legal/privacy)) | The data subject |
| Whatever your agents put inside a briq              | Processor ([DPA](https://briq.cloud/legal/dpa))                 | Controller       |

briq does not read, index or train on what is inside your briqs.

## Providers

| Provider                | Role                                             | Where              | Handles data inside briqs         |
| ----------------------- | ------------------------------------------------ | ------------------ | --------------------------------- |
| Infrastructure provider | Runs briqs: compute, volumes, logs               | Your team's region | Yes (DPA sub-processor)           |
| Hosting provider        | Runs the control plane: API, dashboard, database | Amsterdam          | Metadata only (DPA sub-processor) |
| Email delivery provider | Sends service email                              | United States      | No                                |
| Analytics provider      | Audience measurement                             | Frankfurt          | No                                |

All are US-parented and bound by data processing agreements. We name each on request:
[privacy@briq.cloud](mailto:privacy@briq.cloud).

## What is in place

| Document or process                                                                    | Status                             |
| -------------------------------------------------------------------------------------- | ---------------------------------- |
| [Privacy notice](https://briq.cloud/legal/privacy) and [cookies](https://briq.cloud/legal/cookies) (Arts. 13–14, ePrivacy) | Published                          |
| [Data processing agreement](https://briq.cloud/legal/dpa) (Art. 28)                                      | Published, part of the terms       |
| [Terms of service](https://briq.cloud/legal/terms)                                                       | Published                          |
| Record of processing (Art. 30)                                                         | Internal                           |
| Data subject requests (Arts. 15–22)                                                    | Written procedure, handled by hand |
| Breach procedure (Arts. 33–34)                                                         | Written procedure                  |

## Contact

Data requests: [privacy@briq.cloud](mailto:privacy@briq.cloud). Security reports:
[security@briq.cloud](mailto:security@briq.cloud), see
[responsible disclosure](https://briq.cloud/docs/security#responsible-disclosure). You can also complain to the
[CNIL](https://www.cnil.fr/fr/plaintes).