# EU compliance

> INFRO data-processing locations, retention controls, DPA execution and provider responsibilities, including the current absence of EU data residency.

Source: https://infro.io/docs/compliance/eu

> **Note:** INFRO is in private early access. Running these examples requires an early-access account, an active trial or subscription entitlement, and your own provider connection. Self-serve purchasing is not generally open. See [Early access](https://infro.io/early-access).

> **Note:** INFRO does not currently provide guaranteed EU-only processing or data residency. An EU provider endpoint, a Frankfurt database, or a `routing.regions` field does not constrain the entire INFRO request path to the EU.

## Where processing happens

INFRO uses Cloudflare infrastructure. The gateway Worker is placed near its primary database in Frankfurt, a performance setting rather than a residency guarantee; requests enter Cloudflare at the nearest edge location, and the website and consoles are served globally. Model requests run on the provider accounts and deployments you connect. Review the location and transfer terms of each provider, including every fallback target. See the [subprocessor list](https://infro.io/subprocessors) and [DPA](https://infro.io/dpa).

## Retention controls

Optional prompt and response capture is off by default. Organization opt-in, plan entitlements and a per-request `logging: false` setting control it. Async job records and delivered media are separate from optional request logs. INFRO logging settings do not change provider-side retention. See [Privacy and data](https://infro.io/docs/privacy).

## Data processing agreement

The [DPA](https://infro.io/dpa) is published for review and executed by email with the applicable transfer documentation. There is no console countersigning flow. Your organization may act as a controller or as an authorized processor; provider agreements must match your actual processing arrangements.

## Records and data requests

Request metadata, cost attribution, model and connection identifiers, and administrative audit records can support your own reviews. Export or preserve records within the applicable retention window. Contact support for assistance with access or deletion requests; the platform does not replace your organization's data-protection obligations.

## Certifications and availability

INFRO holds no SOC 2 or ISO 27001 certification, and an independent penetration test is not claimed. SSO and SCIM are available from the Business plan. Review the [Trust Center](https://infro.io/trust) and discuss mandatory requirements before purchase. Using INFRO does not by itself establish GDPR or AI Act compliance.