EU data residency for oil & gas software.
Residency claims are easy to make and hard to check. This is what the claim should mean, what it usually omits, and exactly where RelyentX sits, including the part that is inconvenient for us.
Residency is a claim about several things at once
A vendor saying "EU-hosted" is usually talking about where the servers are. That is one of at least six places your data sits: compute, file and object storage, the database, any search or index tier, outbound email, and whatever the product sends to a third party while it is working.
The last one is where residency claims quietly fail, and it has grown as a category precisely because AI features arrived faster than AI hosting did. A platform can run entirely inside the EU and still ship the text of every record you write to a model endpoint on another continent, in real time, as a normal part of operating.
Where RelyentX runs, and where that is enforced
Compute, object storage, the database, the vector store, the equipment knowledge graph and every self-hosted service run in EU datacentres. Outbound transactional email is pinned to its provider’s EU region.
That is enforced in the infrastructure code rather than promised in prose: the region variable in the Terraform roots accepts only EU datacentres and rejects anything else outright, with an error message naming data residency as the reason. A future engineer cannot move the environment out of the EU by editing a value; the plan fails.
Hosts that carry tenant data resolve by DNS only and connect straight to the EU machines. The API, per-tenant dashboards and sign-in are not served through a global edge network. Only the public marketing site and the operator console sit behind the edge, and neither carries tenant data.
Read all of that as scoped to storage and delivery, because two AI services sit outside it and the next section is about them. A residency claim stated without that qualification in the same breath is false by implication, which is why it is here rather than only below.
The exception, stated plainly
Two AI services sit outside that pinning today, and both receive your text. Search indexing sends the text of each record and document to a third-party embedding API as it is written, and the copilot sends your question plus the retrieved context to a third-party inference API when you ask. Neither endpoint is EU-pinned today. If your jurisdiction requires it, raise it before a pilot. This is the honest state of it, not a footnote.
One thing that paragraph leaves implicit and this page should not: documents are read as well as indexed. When local text extraction is not confident about a page, its image goes to the same third-party reading service.
If your jurisdiction, your customer or your own data-protection assessment does not permit that, say so before a pilot rather than after. It is a scoping conversation, not a disqualification.
The category that is never sent
One class of file is carved out entirely. An attachment that only evidences a person’s identity or health, a passport, a visa, a medical certificate, a fitness-to-work record, is stored, served and represented in the knowledge graph, but is never sent to a third-party embedding or vision endpoint.
The consequence is deliberate: those documents are not searchable by content, because making them searchable would mean sending them. That is the trade, and it was taken in that direction on purpose.
How to check a residency claim rather than trust it
Ask which sub-processors receive customer data and what each one gets. A vendor that answers with a maintained list is telling you something; a vendor that answers "we are GDPR compliant" is not, because that is a statement about paperwork rather than about geography.
Ask specifically what the AI features send, and when. "Only when a user asks the assistant" and "the text of every record, as it is written" are very different answers. Ours is both: the second for search indexing, the first for the copilot.
Ask what evidence exists after the fact. In RelyentX, a record that a file’s contents left the platform is written to an append-only log before the call is made, and it outlives the file itself, so the question "was this document ever sent anywhere" has an answer even after the document is deleted.
Ask what happens to a document the system could not read locally. This is where page images tend to leave a platform without anyone deciding it should happen.
What we would change if you needed it
A dedicated-store tier, for tenants whose size or residency rules require their own database and stores rather than the pooled, row-level-security-scoped tier every tenant runs on today, is part of the committed model and is not yet on the shipped surface.
Moving model inference and embedding inside the EU boundary is a real conversation and not a configuration flag; it changes which providers are available and what the copilot costs to run. Raise it early enough and it can shape a pilot rather than block one.
Common questions
Is RelyentX hosted in the EU?
Compute, object storage, the database, the vector store, the graph store and outbound email are all pinned to EU regions, and the infrastructure code rejects a non-EU region rather than accepting it silently. Two AI services are the exception: the embedding API that makes records searchable and the inference API that answers copilot questions both receive your text and neither is EU-pinned today.
Does our data go to a third-party AI provider?
Yes, in two places, and they are named rather than characterised. The text of each record and document goes to an embedding provider as it is written; your copilot questions plus the retrieved context, and the page images of documents local extraction is not confident about, go to an inference provider. Attachments that evidence only a person’s identity or health are excluded from both and are never sent.
Can we get a dedicated database in our own region?
Not today. Every tenant runs on the pooled tier, with a row-level-security predicate on every tenant-scoped table plus its own vector collection and graph database. A dedicated-store tier is part of the committed model and is not yet on the shipped surface, so raise it before a pilot if you need it.
How can we prove a specific document was never sent to a third party?
Every time a file’s contents leave the platform, an append-only record is written before the call is made, keyed to the attachment and outliving it. The absence of a record for a document is therefore evidence rather than an assumption, and it survives that document being deleted.
Guides
See it against your own equipment data.
A walkthrough on your asset classes, your certificate disciplines, your job cards, not a canned demo.