Where data is stored

PhotoLog’s platform sends each photo or video to one of three places, chosen by the account’s plan and by the studio’s own settings — never to a single, undifferentiated pool of “our servers”:

A default managed storage tier, used by most plans.
A premium managed storage tier, used by a smaller set of plans.
A studio’s own storage, for BYOS studios — a bucket the customer connects and controls. See bring your own storage for how that works; this page only states who chooses that bucket’s location, below.

Which of the two managed tiers an upload goes to, and the studio’s own storage where BYOS applies, is decided by the account’s plan at the moment of upload — not chosen per photo.

The two managed tiers run on different infrastructure providers. The default tier runs on Wasabi, an S3-compatible object storage service. The premium tier runs on Cloudflare R2. Naming these providers is a statement about where the encrypted bytes are stored, not about encryption itself — photos and videos are encrypted on your device before upload (see how encryption works); nothing about where the resulting ciphertext is stored changes that.

What we can confirm about region, and what we cannot

In the infrastructure configuration we can inspect for our own staging environment, the default managed tier’s storage is configured in the region Wasabi identifies as eu-central-1. We have not been able to independently confirm that production’s configuration is identical, and we are stating that gap rather than assuming the two match — this project’s own engineering records explicitly warn against inferring a production environment’s shape from a staging one, and we are holding ourselves to that same standard here rather than writing a reassuring sentence we cannot back up.

Cloudflare R2, the premium tier, does not expose a single fixed region the way a traditional S3 region does — Cloudflare places R2 objects across its own network unless a customer configures a jurisdictional restriction. We have not found a record of such a restriction being configured for PhotoLog’s premium tier, so we are not asserting one exists.

We do not name a certification for either tier. The previous version of this page said data was stored in “certified data centers” without naming which certification. We have not found a record of a specific certification (ISO 27001, SOC 2, or similar) that applies to PhotoLog’s storage providers, so we do not repeat that claim here in any form. If that changes, this page will name the certification specifically rather than use the word on its own.

Where PhotoLog’s application itself runs

Storage location and compute location are different questions. Where the servers that run PhotoLog’s application code are hosted is, as far as we can confirm from the infrastructure configuration available to us, a staging-environment detail only: that environment runs from a single location in Nuremberg, Germany. We have not found an equivalent record for the production environment, and — for the same reason given above — we are not assuming it matches staging.

BYOS residency: the customer’s own choice

A BYOS studio’s storage lives in a bucket the customer supplies. The customer chooses that bucket’s provider and region, not PhotoLog. PhotoLog does not select, restrict, or guarantee where a BYOS bucket physically sits — that choice, and the responsibility that comes with it, stays with whoever connected the bucket. If your own residency requirements are specific — a particular country, a particular provider — a BYOS studio is how you satisfy them yourself, rather than a setting PhotoLog exposes on the managed tiers above.

How this relates to encryption

This page answers a different question from how encryption works. This page is about where the encrypted bytes physically sit. The encryption page is about who can read them. Knowing where a file is stored is not the same as being able to read what is inside it, and neither claim should be read as covering the other — a reader with a residency question should look here, and a reader asking who can access the contents should look there.

What we cannot yet confirm

Stated together, so nothing above is mistaken for more certainty than it has:

The exact region(s) used by PhotoLog’s production storage, as distinct from the staging configuration named above.
Whether Cloudflare R2 is configured with any jurisdictional restriction for PhotoLog’s premium tier.
Where PhotoLog’s production application servers are physically hosted.
Any named third-party certification covering PhotoLog’s storage providers.

We would rather list these plainly than fill them with language that sounds reassuring and settles nothing. This page will be updated as each of these is confirmed.

Sources

The claims above are drawn from PhotoLog’s own engineering records, read directly rather than taken from a summary:

The upload code that routes each photo to one of the two managed tiers or to a studio’s own storage, by plan, and an internal engineering review that traced and confirmed which provider each of the two managed tiers resolves to.
The project’s own measurement of the premium tier’s real production contents as of its most recent recorded check, showing it held no live customer data at that time.
The project’s staging infrastructure configuration (infra/tofu/variables.tf for the application server’s location; the staging storage configuration template for the default tier’s region).
The project’s own engineering notes on why a staging environment’s configuration must not be assumed to match production.

These are internal engineering documents, not customer-facing artifacts, and are referenced here by description rather than by name or link for that reason. A formal, hash-verified citation entry for each of these could not be completed in this session — see this phase’s own summary for the full path-level detail and the reason.

How we verified this

Every statement above was checked against PhotoLog's own source and documentation on the date shown. Where the source did not settle a question, the page says so rather than filling the gap.

PhotoLog's managed storage routes to a non-premium or premium tier by a stored tier value on the studio (verified 2026-08-27)
The default managed tier runs on Wasabi and the premium managed tier runs on Cloudflare R2 (verified 2026-08-28)
The Wasabi region PhotoLog configures is eu-central-1 — evidenced in the staging environment template, not in any production configuration this project can read (verified 2026-08-27)
The Wasabi endpoint PhotoLog uses resolves to the eu-central-1 regional host (verified 2026-08-27)

Data residency