Data Residency & GDPR Compliance

Data Residency That Goes Beyond Promises

Most collaboration platforms offer data residency as a configuration option — a dropdown menu in an admin panel that routes certain data to a preferred region. The reality behind that dropdown is often more complicated. Metadata may flow through global CDNs. Support tools may process data in the provider’s home jurisdiction. Encryption keys may be managed centrally, outside the customer’s chosen region.

Mandraki takes a fundamentally different approach. Data residency is not a setting. It is a structural property of the platform. Every component of the system — application servers, databases, media servers, file storage, encryption key management, and AI processing — operates exclusively within the European Union, on infrastructure owned and operated by a European company.

What “EU Data Residency” Means at Mandraki

Application and database servers are hosted in EU data centres operated by our European hyperscale provider. All persistent data — user accounts, organisation settings, messages, call records, and files — is stored in PostgreSQL databases that never leave EU jurisdiction.

Media processing occurs on Selective Forwarding Units (SFUs) located within the EU. Video and audio streams are routed through European servers, and when end-to-end encryption is enabled, the media content is encrypted before it reaches the server.

File storage and recordings use EU-based object storage. Files are encrypted at rest using organisation-specific keys, and those keys themselves are wrapped by a master key that never leaves the EU.

Encryption keys are generated, stored, and managed within EU infrastructure. Organisations that require additional control can use Bring Your Own Key (BYOK) to manage their master key through their own key management service, ensuring that even Mandraki cannot decrypt their data.

AI processing — transcription, summarisation, and smart replies — runs on EU-hosted compute. When AI features are enabled, data is processed transiently and never exported outside the EU. Organisations can disable AI features entirely, or require per-call consent from all participants.

Metadata and logs remain within the EU. There is no global analytics pipeline siphoning telemetry to a foreign jurisdiction. Operational telemetry is processed and stored on the same EU infrastructure as the application itself.

GDPR Compliance by Design

The General Data Protection Regulation imposes strict requirements on how personal data is collected, processed, stored, and transferred. Mandraki’s architecture is designed to satisfy these requirements at a technical level, rather than relying solely on contractual mechanisms.

Lawful basis. Mandraki processes personal data on the basis of contractual necessity (to provide the collaboration service) and, where applicable, the legitimate interests of the data controller (the customer organisation). We do not process personal data for advertising or profiling.

Data minimisation. The platform collects only the data necessary to deliver its functionality. Telemetry is anonymised and stripped of personally identifiable information before storage.

Right to erasure. Organisations can delete user accounts, messages, call recordings, and associated data. Deletion propagates through all storage layers, including backups, within the retention period specified by the organisation’s data retention policy.

Data portability. Organisations can export their data in standard formats. Messages, call metadata, and files can be extracted for migration or archival purposes.

Data Protection Impact Assessments. Mandraki provides documentation and technical specifications to support customers in conducting their own DPIAs, as required by Article 35 of the GDPR.

No Schrems II risk. Because all data processing occurs within the EU on European-owned infrastructure, there is no international data transfer to assess. The complex legal analysis required by the Schrems II ruling — adequacy decisions, supplementary measures, transfer impact assessments — simply does not apply.

For Regulated Industries

Organisations in healthcare, financial services, government, and legal sectors face additional regulatory requirements beyond the GDPR. Mandraki’s architecture supports sector-specific compliance by providing verifiable data residency, granular access controls, audit logging, and encryption that meets or exceeds the expectations of national regulators.

Data residency is not a premium add-on. It is how Mandraki works, for every customer, on every plan.