Data residency

"Data residency" means the part of the world where your data is stored. Renewly has two regions: the European Union and the United States. You choose one when you sign up, and your contracts and account stay there for as long as you use Renewly.

This page explains what that covers in plain words. The trust page has the full technical list.

Choosing your region

You pick your region on the sign-up form. There are two:

• European Union - stored with Supabase, our database provider, in AWS Frankfurt (eu-central-1).
• United States - stored with Supabase, our database provider, in AWS N. Virginia (us-east-1).

You can see your region at any time in Settings → Account, on the Data residency card.

Your region cannot be changed from the settings pages. Changing it later means moving your whole workspace from one database to the other. If you think you need that, email support@renewly.gg to talk it through.

What stays in your region

All of the following is stored only in the region you chose:

• The contract files you upload.
• The details Renewly reads from your contracts, such as dates, values and terms.
• Your account, your profile and your organisation's details.
• Emails you forward to your Renewly inbox address, their attachments and the contracts created from them.
• Your audit log, the record of who did what (kept for 3 years).

Reading your contracts also happens in your region. Renewly reads each contract once and then runs a second check on what it found. Both steps run on services in your own region: in the EU for EU customers, and in the US for US customers.

What crosses region

Nothing in the reading of your contracts leaves your region. Every step runs in the region you chose when you signed up.

If your organisation's rules mean you want the second check switched off, email security@renewly.gg. We switch it off for your organisation on our side, so there is nothing for you to change. Renewly still reads your contracts, but without the second check the results can be slightly less accurate.

Operational logs

A few of the services that keep Renewly running (website hosting, error tracking, background jobs and rate limiting) work from a single location rather than one per region. Their technical logs, such as request details, reference numbers and region labels, may be handled outside your region.

• Uploaded contract files pass through our website hosting service before they are stored in your chosen region.
• We remove email addresses, supplier names, contract titles and amounts from our own logs before they are written.
• In rare cases, when a background job fails, the error message it records can quote part of a reply about a contract.
• Emails we send you, such as renewal reminders, go through our email service, which is based in the US. Emails you forward to your inbox address arrive through the same service before they are stored in your region.

The trust page lists each of these services and exactly what it receives.

Data export and deletion

You can download a copy of your data yourself at any time, without asking us. Go to Settings → General and click Export all data in the Data & Storage section. You need two-factor authentication or a passkey set up first. This is your right of access under GDPR Article 15.

If you delete your account, deletion is scheduled rather than immediate. You have 30 days to change your mind and cancel it. After that, deletion can proceed. If a legal hold applies to your data, deletion waits until the hold is lifted.

More detail

• The trust page - the full map of regions, the companies that process data for us, and our operational services.
• The security page - how we protect your data.
• Privacy Policy - the legal text, including how data transfers between countries are covered.