Takos Docs

テーマ切替

Legal: Data Residency Policy ​

このページでわかること: Takos の residency profile、data class ごとの region rule、provider-specific limitation、production residency evidence boundary。

This policy defines how Takos offers regional handling of Customer Personal Data. It is a product and operations policy, not a guarantee that every sub-processor can be forced into one jurisdiction for every processing purpose. Customer contracts must reference the exact residency profile, provider set, and exceptions that apply to that customer.

Status ​

FieldValue
OwnerData protection owner
Last reviewed2026-05-07
ScopeTakos Web / API, Git service profile, agent runtime profile, Takosumi/operator-managed deploy/runtime operations used by Takos spaces
Current statusPublished policy
Evidence ruleProduction spaces record residency profile, primary region, provider set, and approved exceptions

Boundary ​

Takos is delivered through the Takosumi Capsule lifecycle. Account, authentication, contract, and billing are owned by Takosumi Accounts (the Takosumi Account home region applies). Takos takos provides the public API / UI surface and stores app-local profile derived from the Takosumi Accounts subject in the same residency profile. Takosumi kernel is the generic deploy-control ledger substrate and records Capsule / Run / StateVersion / Output evidence; it inherits residency requirements only when Takos uses it to operate a customer space or deployment.

Residency decisions attach to the customer space / deployment profile, not to a local client convention.

Residency Profiles ​

ProfileCustomer-facing meaningRequired production handling
globalNo strict regional commitment. Suitable for development, pilots, public docs, or customers without residency requirements.Data may be processed by approved providers in their normal service locations.
usCustomer workload data should be stored and processed in the United States where the provider supports it.Use US cloud regions, US-capable AI project configuration, and US metadata/logging controls where available.
euCustomer workload data should be stored and processed in the EEA / Switzerland where the provider supports it.Use EU cloud regions, EU-capable AI project configuration, and EU metadata/logging controls where available.
jpCustomer workload data should be stored in Japan where the provider supports it. Processing may require explicit exceptions for services that only offer regional storage.Use Japan cloud regions and Japan-capable provider storage. Any out-of-region processing must be recorded as an exception.

No paid production tenant may be onboarded with a residency commitment unless the order form or private deployment record names the profile, primary region, and any approved exceptions.

Data Class Rules ​

Data classResidency rule
Account identity and authentication metadataCapsule 台帳 (ownership ledger / pairwise OIDC subject / account-plane capability record) follows the Takosumi Account home region stored by the operator account plane (reference impl: Takosumi Accounts). Takos itself is an OIDC consumer and stores app-local profile fields (chat / memory / preferences / app-local cache derived from the account-plane subject) in the Capsule primary region declared by the residency profile. Under default deploys the Takosumi Account home region and the Capsule primary region are the same; cross-region installs may separate them and are recorded as a residency exception with both regions named. Google OAuth and other upstream identity providers may process authentication data under their own regional terms.
Billing and payment metadataStripe or the operator-selected payment provider handles card and payment processing under its terms. Billing identifiers, invoices, subscription state, and payment status are owned by the operator account plane / BillingPort. Takos stores only app-local usage or metering mirrors needed to report Capsule usage back to takosumi.billing.usage.
Space data and application dataStored in the residency profile's primary region when Takos operates the storage provider for Customer.
Git repositories and source artifactsStored in the residency profile's primary region when hosted through the Git service profile or operator-managed object storage.
Run records, prepared source, and runtime bundlesStored in the selected runtime target region. A cross-region profile change is a STATE_TRANSITION requiring independent review, isolated rehearsal, and a forward-repair plan; routine release promotion alone does not authorize it.
Agent prompts, messages, tool context, files, and AI outputsSent only to an AI provider/project compatible with the residency profile, or treated as an explicit out-of-region processing exception.
Runtime logs, audit logs, and telemetryStored in-region where provider controls support it. Security, abuse, and operational logs may have narrow exceptions documented in the order or incident record.
Backups and DR copiesStay in the same residency profile unless Customer approves a cross-region DR exception.
Support exports and incident evidenceMay leave the profile only with Customer approval, legal requirement, or incident commander approval recorded in the incident timeline.

Provider-specific Handling ​

ProviderPolicy requirement
CloudflareUse Regional Services and Customer Metadata Boundary where a strict EU or US profile depends on Cloudflare edge / log controls. Cloudflare notes that Customer Metadata Boundary is an Enterprise Data Localization Suite feature and that some operational/account/configuration metadata is outside the boundary.
AWSUse the Customer-selected AWS Region for workload storage and processing. AWS DPA terms state that Customer can specify Regions and AWS will not transfer Customer Data from selected Regions except for service, law, or valid order needs.
Google CloudUse specific Google Cloud regions for GKE / storage / database resources and verify each selected service supports data residency for the requested location.
OpenAIConfigure data residency per OpenAI API project where AI features are in scope. US and Europe currently support regional storage and processing; non-US regions may require approved abuse-monitoring controls or Zero Data Retention and may support regional storage without regional processing.
StripeTreat payment processing as a mixed-role / payment-network exception. Takos cannot promise strict workload-region residency for card network, tax, fraud, or compliance processing handled by Stripe.
Google OAuthTreat identity-provider authentication as a third-party identity processing exception unless a customer-specific enterprise identity arrangement provides stricter terms.

Operational Requirements ​

Every production space with a residency commitment must have:

  1. residencyProfile: one of global, us, eu, or jp.
  2. primaryRegion: the cloud/provider region used for authoritative storage.
  3. allowedProviders: the approved provider list for hosting, storage, AI, identity, billing, logging, and support.
  4. exceptions: provider, data class, purpose, duration, and approval owner for any out-of-profile processing.
  5. profileChangePlan: documented steps for changing profile or primary region.
  6. evidencePath: private deployment record, order form, or customer security packet proving the profile was configured before production traffic.

Cross-region replication, DR copies, support exports, and model-provider fallbacks are disabled by default for strict us, eu, and jp profiles unless an exception is recorded.

Enforcement Evidence ​

For a managed production tenant with a residency commitment, the operator keeps private evidence for the configured profile:

EvidenceRequired proof
Region bindingRuntime profile or private config maps the space to the selected provider region.
Storage locationDatabase, object storage, repository storage, and backup targets are in the selected region/profile.
AI routingAI requests use the region-specific provider project / endpoint or the customer has an exception.
Logging locationRuntime, audit, and telemetry storage location is documented.
Access logOut-of-region administrative/support access is logged or disabled.
Sub-processor matchActive providers match /legal/subprocessors.

Customer Disclosure ​

Customer-facing proposals and order forms must avoid broad claims such as "all data stays in region" unless every data class and provider exception has been reviewed. Use the narrower wording:

Takos stores Customer workload data in the selected residency profile where the configured provider supports regional storage. Identity, payment, support, security, abuse monitoring, and selected AI processing may follow provider-specific terms or documented exceptions.

Provider source links reviewed on 2026-05-07: