Version 1.0 --- Effective 2026-10-01 · last updated 2026-09-12
This page identifies BOMSync's current production hosting locations and explains how regional provisioning works.
Contractual commitments are governed by the Terms of Service, applicable Order Form, and Data Processing Addendum. If an Order Form contains a specific residency commitment, that commitment controls for the applicable Customer.
1. Core production locations
Data / Service Current location
Identity, authentication, and France Central (European AuthDB account records Union)
Tenant application databases France Central (EU) or East US, depending on tenant provisioning
Azure Blob document/object France Central (EU) or East storage US, depending on tenant/project provisioning
Standard backups Maintained in the geography appropriate to the applicable production resource, subject to Azure service configuration and BOMSync backup architecture
Azure Key Vault Provisioned with the applicable BOMSync production environment; used for production secrets and supported Customer-provided AI/API credentials
Azure Communication Services United States data location
Azure AI Document Intelligence / Depends on the configured Azure Azure OpenAI service and deployment used for the applicable feature
Anthropic / OpenAI provider Provider processing locations processing under the applicable provider terms; see the Subprocessor List
2. Tenant region
BOMSync currently supports tenant database and object-storage provisioning in France Central and East US.
The tenant's configured region may depend on:
- provisioning choice;
- customer location;
- applicable Order Form;
- feature availability;
- storage or performance requirements; and
- an agreed residency requirement.
Customers may request confirmation of their current tenant/storage configuration through privacy@bomsync.com or an applicable enterprise support channel.
3. EU-hosted Customer Data
Where Customer Data is provisioned for storage at rest in the EEA, BOMSync will not relocate that Customer Data at rest outside the EEA into a non-EEA region without at least 30 days' prior written notice, except where the relocation is requested or otherwise expressly agreed by Customer.
If Customer objects in writing before the effective date and BOMSync proceeds with the relocation, the termination and pro-rata refund rights stated in the Terms apply to the affected subscription.
This commitment does not mean that all support, subprocessors, communications, or AI processing occurs exclusively within the EEA.
4. Cross-border access and subprocessors
BOMSync personnel and subprocessors may access Customer Data from other jurisdictions as necessary to provide, secure, support, and maintain the Service.
Where personal data is transferred from the EEA or UK to a jurisdiction requiring a transfer mechanism, BOMSync applies the safeguards described in the DPA.
The current list of subprocessors and their processing purposes is maintained at:
</legal/subprocessors>
5. AI processing location
AI processing should not be inferred solely from the tenant database or Blob region.
BOMSync may use:
- Azure AI Document Intelligence;
- Azure OpenAI;
- Anthropic;
- OpenAI; and
- Customer-selected providers through supported BYOK functionality.
Provider and deployment details are described on the Subprocessor List. Customer BYOK provider-side processing is governed by Customer's own relationship with the selected provider.
Customers with strict AI-processing residency requirements should obtain a written commitment in an Order Form before enabling the affected AI functionality.
6. Dedicated storage and retention
Standard BOMSync backup rotation is designed not to exceed 90 days, subject to the applicable service architecture and legal-retention obligations.
Where offered, a Customer may purchase or configure a different retention period for a dedicated storage container. A dedicated-container retention setting applies only to the storage expressly covered by that configuration and does not automatically modify database backups, audit logs, security logs, billing records, or other BOMSync systems.
7. No implied single-country guarantee
Unless a specific written residency commitment appears in an Order Form, BOMSync does not promise that all Customer Data, support access, subprocessors, backups, AI processing, communications, or operational metadata will remain within a single country.
Customers subject to public-sector, defense, regulated-industry, contractual, or project-specific residency rules are responsible for identifying those requirements before uploading regulated data.
8. New regions
BOMSync may add additional production regions as the Service grows.
The addition of a region does not by itself relocate an existing Customer's data. Relocation of EEA-hosted Customer Data at rest is subject to the commitments described above.
9. Contact
Privacy / residency questions: privacy@bomsync.com
Security questions: security@bomsync.com
Enterprise contractual requirements: legal@bomsync.com