Hosting Locations and Data Residency
This page states where each PKI-as-a-Service component runs and what customer data it holds, so that security, privacy and procurement teams can assess data residency requirements.
Where each component runs
| Component | Hosting | Location / region |
|---|---|---|
| Root CA | EC-managed environment, kept offline | Secured, offline EC-managed environment; exact location shared under NDA on request |
| Issuing CA(s) | EC-managed Azure environment | EC-managed Azure region agreed during design and recorded in the Client Intake Form; details shared under NDA on request |
| Hardware Security Modules | EC datacenter (FIPS 140-3 Level 3) | Secured EC datacenter; protected HSM backup held in a separate secure location; details shared under NDA on request |
| CDP and AIA (CRLs, CA certificates) | Azure Blob Storage, geo-redundant | Geo-redundant Azure Blob Storage (primary region with an Azure-paired secondary region); details shared under NDA on request |
| Self-Service Portal and API | EC-managed environment | EC-managed environment; details shared under NDA on request |
| Backups | EC-managed | Separate secure EC-managed storage; details shared under NDA on request |
Customer data held by the service
| Data | Where it is held | Purpose |
|---|---|---|
| Issued and imported certificates (public data) | Issuing CA database and portal inventory | Lifecycle management, reporting, revocation |
| Certificate requests (CSRs) and request metadata | Issuing CA database and portal | Issuance and audit |
| Portal user details (name, email, role, department) | Portal | Access control and notifications |
| Audit and activity logs | Portal and CA Windows Security log | Security monitoring and compliance evidence |
| CRLs and CA certificates (public data) | Azure Blob Storage | Certificate validation by relying parties |
Note: Subject names, email addresses and device names in certificates can be personal data. Design certificate profiles so that only the attributes that are needed are included.
Regional requirements
Customers with data residency requirements record them in the Client Intake Form (Security and Compliance Requirements). EC reviews these requirements during design and confirms the hosting options available.