# EU residency & security

EU-hosted by design, GDPR as baseline, keys hashed and never stored in the clear.

> Status: Design

## EU-native by default

Processing is EU-region by default. API keys are argon2id-hashed with constant-time comparison; upstream provider keys in proxy mode pass through and are never logged. Prompt-content logging is off by default in cloud and opt-in per org.