Data Residency Model

Design principle

Each tenant has a home region (KR, JP, SG, or ID). Data at rest — D1 database records and KV entries — is stored only in that region’s Cloudflare data centre.

Implementation

• The core-platform Worker uses SUPPORTED_REGIONS to validate residency assignments.
• The infra-control-plane writes regionCode into the tenants table at provisioning time.
• D1 databases are provisioned per-region (separate D1 IDs per environment).
• KV namespaces use region-prefix keys: KR:tenant:<id>:session:<token>.

Compute vs storage

Compute always runs at the nearest edge PoP (global). Only persistent storage is constrained to the home region. This means:

• Latency for compute is globally optimised.
• Sensitive data (PII, billing) never leaves the home region’s D1.

Tenant migration

Changing a tenant’s region is a manual runbook operation. See Runbooks → Provision Tenant.