Data residency
Where your encrypted files are stored is a separate question from how they are encrypted. This page names the storage provider PhotoLog uses, the regions and jurisdictions you choose from when you create a studio, and where the application itself runs.
Where data is stored
PhotoLog’s platform sends each photo or video to one of two places, never to a single, undifferentiated pool of “our servers”:
- PhotoLog’s managed storage, used by every plan that does not connect its own bucket.
- A studio’s own storage, for BYOS studios - a bucket the customer connects and controls. See bring your own storage for how that works; this page states who chooses that bucket’s location, below.
Managed storage runs on Cloudflare R2. Naming the provider is a statement about where the encrypted bytes are stored, not about encryption itself - photos and videos are encrypted on your device before upload (see how encryption works), and nothing about where the resulting ciphertext sits changes that.
There is one managed storage tier. Uploads from a managed studio go to it; there is no second tier to route between and no per-photo choice to make.
Choosing a region or a jurisdiction
You choose where a studio’s managed storage sits, when you create the studio. The choice is made once, per studio, and is one of:
- A region - APAC, EEUR, ENAM, OC, WEUR or WNAM.
- A jurisdiction - EU or US. A jurisdiction constrains where objects may sit without pinning them to one region within it.
The available regions and jurisdictions follow what Cloudflare offers, so this list is subject to change. If a specific country or a specific provider is your requirement rather than a region or a jurisdiction, a BYOS studio is how you satisfy it - see below.
Certification
Cloudflare, which holds PhotoLog’s managed storage, is certified to ISO 27001 and reports under SOC 2. Those are Cloudflare’s certifications for Cloudflare’s infrastructure, published by Cloudflare, and they are named here so the claim is checkable rather than left as the word “certified” on its own:
A certification held by a storage provider is a statement about that provider’s operations. It is not a statement about PhotoLog’s own application, its code, or its encryption design - for what has and has not been reviewed there, see how encryption works.
Where PhotoLog’s application runs
Storage location and compute location are different questions. PhotoLog’s application runs in a European datacentre provided by Hetzner. Hetzner publishes its own certifications at hetzner.com.
The specific datacentre may vary with availability, and it is our intention to run PhotoLog across more than one datacentre so that the application is replicated. That is a statement of intent about the application, not a commitment we are making about a date, and it does not change where your stored objects sit - that is the region or jurisdiction you chose for the studio, above.
BYOS residency: the customer’s own choice
A BYOS studio’s storage lives in a bucket the customer supplies. The customer chooses that bucket’s provider and region, not PhotoLog. PhotoLog does not select, restrict, or guarantee where a BYOS bucket physically sits - that choice, and the responsibility that comes with it, stays with whoever connected the bucket. If your residency requirements are more specific than the regions and jurisdictions above - a particular country, a particular provider - a BYOS studio is how you satisfy them yourself.
How this relates to encryption
This page answers a different question from how encryption works. This page is about where the encrypted bytes physically sit. The encryption page is about who can read them. Knowing where a file is stored is not the same as being able to read what is inside it, and neither claim should be read as covering the other - a reader with a residency question should look here, and a reader asking who can access the contents should look there.
What this page does not state
Listed so nothing above is read as covering more than it does:
- Which physical datacentre within your chosen region or jurisdiction holds a given object. You choose the region or the jurisdiction; placement within it is Cloudflare’s.
- A certification held by PhotoLog itself. The certifications named above are Cloudflare’s and Hetzner’s, for their own infrastructure.
- A guarantee about the specific Hetzner datacentre, which may vary with availability.