> ## Documentation Index
> Fetch the complete documentation index at: https://developers.essal.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Privacy

> How Essal handles your data — storage locations, data residency, deletion policies, and privacy controls.

Essal is committed to handling workspace data with transparency and control. This page explains how data is stored, where it resides, and what controls you have over it.

## Data Storage

All workspace data — documents, contacts, tasks, audit logs, and user records — is stored in encrypted, redundant data stores. Storage is logically isolated per workspace; no data is shared between workspaces.

## Data Residency

Essal offers data residency options for workspaces on the Enterprise plan:

| Region       | Location           |
| ------------ | ------------------ |
| EU (default) | Frankfurt, Germany |
| US           | Virginia, USA      |
| APAC         | Sydney, Australia  |

Configure your workspace region during setup. Regions cannot be changed after initial configuration.

<Warning>
  Cross-region data transfers are subject to applicable data protection regulations (e.g. GDPR for EU-resident data). Ensure your chosen region aligns with your legal obligations.
</Warning>

## Data Retention

| Data Type              | Default Retention     | Configurable?                     |
| ---------------------- | --------------------- | --------------------------------- |
| Documents and files    | Until deleted by user | No                                |
| Audit logs             | 90 days               | Yes (up to 7 years on Enterprise) |
| Webhook delivery logs  | 30 days               | No                                |
| Deleted entity records | 30 days (soft delete) | No                                |

## Right to Erasure

Essal supports GDPR Article 17 right-to-erasure requests. To permanently delete a user's personal data:

```bash theme={null}
DELETE /v1/access/users/{id}?erase_personal_data=true
```

This anonymises the user's attributed content and removes their PII from all records within 72 hours.

## Sub-Processors

Essal uses a limited number of vetted sub-processors for infrastructure, monitoring, and support tooling. The current sub-processor list is maintained at [legal.essal.cloud/sub-processors](https://legal.essal.cloud/sub-processors).

## Privacy Contact

To submit a data subject request or report a privacy concern, contact [privacy@essal.cloud](mailto:privacy@essal.cloud).