Data residency
Your data stays where your rules say it must.
Residency rules, sovereignty commitments and your own risk appetite all ask the same thing: where does our data go? With ACSE, the answer is short. Your configuration, your credentials and your evidence stay in your own account. What crosses to ACSE is the shape of the problem, not its contents.
A short answer for your regulator
Raw configuration, resource names and credentials never leave your cloud, by design rather than by promise.
Evidence you hold
The record of every change lives in append-only storage in your account, under your retention.
No surprise moves
Changing the control plane’s region is a recorded request that a second admin must approve.
The boundary
What stays, and what crosses
The ACSE runtime runs in your account. It reads your configuration, evaluates policy, prepares fixes and writes evidence there. A sanitization gateway and a deny-by-default registry decide what may leave.
What reaches the control plane are projections: shapes and counts, such as how many buckets are public. The schema itself rejects resource names, ARNs and ids.
- Resource names, ids and configuration stay with you
- Credentials never leave your account
- Nothing leaves unless the registry classifies it
Projections carry shapes and counts. The schema rejects resource names, ARNs and ids, so they cannot be sent by mistake.
The risk graph is built in your account. ACSE sees the shape of the path, not who or what is on it.
There are no long-lived keys. Connections use workload identity federation and read-only roles you create.
Evidence is written to append-only storage in your account. ACSE can show and verify it, but cannot change it.
Decisions are delivered back to your account and appended to the chain before they count.
Where each part lives
A map of where things run
Customer runtime
In your account. Scans, policy evaluation, fix preparation and the risk graph.
Evidence store
In your account, append-only under Object Lock, with retention and legal holds you control.
AI, if you turn it on
On the model service in your own account, behind the same boundary. Off by default.
Control plane
The portal and approvals, in a region you choose. It holds shapes, counts and decisions.
Outbound only
Every connection opens from your side
Nothing listens inside your account. The runtime opens each connection to the control plane outward and signs every request with your tenant’s own key, with a single-use nonce.
Decisions made in the portal travel back the same way and are chained into your evidence store. A decision counts only once your store confirms it was appended.
Residency controls
The settings that protect it
- Control plane region
- Chosen per deployment; a change needs a second Tenant Admin with recent MFA
- Findings that cross the boundary
- Metadata only, enforced by the sanitization gateway and egress registry
- Evidence retention
- Object Lock retention in your own account
- Legal holds
- Active as soon as they are placed; release takes two people
Questions
What people ask us
Can ACSE staff see our resources?
The control plane never receives resource names or identifiers, so there is nothing there to see. Delegated access for a service provider is read-only.
If we turn on AI, where does inference happen?
On the model service in your own cloud account, reached through a private endpoint. The model receives sanitized inputs and only drafts; people decide.
What happens to our evidence if we stop using ACSE?
It stays in your account, in your storage. The open verifier checks it without ACSE.
Keep reading
Related
Data boundary
ACSE runs in your account and sends only shapes and counts. Names, ids and credentials stay with you, and a deny-by-default registry governs what leaves.
ReadPlatformHow it works
ACSE’s runtime runs in your cloud and connects outbound only, signed. It reads with no keys and keeps evidence in your account. See the architecture.
ReadSolutionsPublic sector
ACSE maps your cloud to CCCS Medium, NIST 800-53 Rev 5 and FedRAMP Moderate, fixes through your own code and keeps sovereign evidence in your account.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.