Tell us where your primary data needs to live. We assess hosting, backups, logs, support, email and AI separately, then document the arrangement in your order. The regions below are options to discuss, subject to provider availability and your requirements.
Tell us whether your requirement concerns primary storage, every copy, external processing or access from other countries. These are different commitments.
The schedule identifies primary hosting, providers, backups, logs, support and enabled integrations. European hosting alone does not settle GDPR compliance or every transfer question.
Country restrictions, dedicated resources and additional assurance require a deployment review. We confirm whether the arrangement can be supported before including it in an order.
A country-specific or defence requirement needs an explicit review. Send us the clause and we will assess the full processing arrangement, including AI and support access.
These are locations to discuss for primary hosting. The order confirms actual availability, provider and scope. Backups, support, logs and AI have separate processing arrangements.
UK primary hosting can be assessed against your requirements; regulated uses require a separate review.
A European primary-hosting option. Transfers and other processing are assessed separately.
A French hosting option, subject to provider and requirement review.
Central and eastern European operations.
A Canadian hosting option. A server location does not remove other applicable laws.
A US hosting option. Federal, export-control and other regulated requirements need separate written assessment.
A location to discuss for APAC operations, subject to availability and review.
A location to discuss for Australian operations, subject to availability and review.
Need a country that isn't listed? Tell us the requirement so we can assess availability and the full processing arrangement before agreeing delivery.
Review these controls alongside the processing schedule and the Security & Support Policy.
The order identifies the primary hosting location and the data it covers. Logs, backups, external processing and support access require separate review.
Backup frequency, destinations, retention and recovery commitments are recorded for the deployment, with operating evidence checked before a guarantee is made.
Bulk uses independent hosting providers. The provider and service for your workspace are identified in the agreed deployment schedule.
Transport, database, file and backup encryption are separate controls. The security attachment records the coverage verified for your deployment.
Dedicated hosting can be specified in an order. The arrangement identifies which compute and storage resources are dedicated and which supporting services are shared.
Application activity records support investigation and accountability. Audit coverage, exports and retention depend on the operation and agreed configuration.
Standards describe how the platform works; commitments describe what we agree to as part of your Enterprise contract: the items your legal and procurement teams look for, on the page so there are no surprises.
On request we share the complete list of third parties that touch your deployment: hosting operator, email delivery, error-tracking. We notify you in advance of adding any new one, so there are no hidden parties.
A GDPR-aligned Data Processing Agreement is signed as part of onboarding, naming Bulk as processor and you as controller, covering data-subject rights, transfers and breach-notification obligations.
The DPA requires notice without undue delay after awareness of a personal data breach. Initial details may be supplemented as the investigation progresses.
The order specifies export access, formats, live deletion and backup expiry. Confirmation of deletion identifies any lawful or scheduled residual retention.
Review the customer policy suite, including the DPA and subprocessor list. Deployment details and any additional assurance requirements must be agreed before adoption.
Send us the requirement. We assess primary hosting, backups, logs, support access, email and AI separately before agreeing a country restriction. A primary hosting location alone is not a guarantee that every processing activity stays there.
Separate deployments can use different hosting arrangements. The accepted order identifies the provider, location and dedicated or shared resources for your deployment.
Bulk uses independent hosting and additional services for functions such as email, backups and AI. Current Vertex AI requests use a global endpoint, with an optional OpenRouter fallback for selected AI requests. See AI & Data Handling for the separate processing boundary.
We can request the assurance information available for the selected facility. Applicable audit rights and access arrangements must be agreed; a provider certification does not certify Bulk.
The agreed deployment schedule must identify backup destinations, frequency, retention, encryption and recovery arrangements. We do not make a universal six-month or same-country backup promise.
The order and processing schedule identify export formats, exit access, live-data deletion and the separate backup-expiry timetable. A deletion confirmation must accurately identify any remaining lawful or scheduled retention.
We can assess the specific country and provider availability. Any new arrangement requires a processing review and an agreed order.
We agree a delivery schedule after reviewing hosting availability, configuration, integrations and any required assurance work. A fixed go-live date applies only when included in the accepted order.
Hosting a regulated system in a specific country can feel like a lot of paperwork. It isn't when we're doing the lifting. Here's the whole path, from first email to live system.
One short email: which country (or countries) you must host in, and why: customer mandate, regulator, internal policy. We follow up on the processing and assurance details.
Following the deployment review, we prepare a draft Data Residency & Processing Statement on Bulk letterhead, tailored to your region.
The statement, DPA, sub-processor list and order form in one self-contained pack, pre-filled with your details. No drip-feed across the week.
The parties complete and accept the order, its processing schedule and any negotiated requirements before provisioning.
We order and configure your dedicated node in the chosen country: hardware, OS, database, backups, monitoring. Nothing for your IT team to stand up.
We agree go-live and onboarding after reviewing the deployment requirements and dependencies. The accepted order records any fixed delivery commitment.
Hosting resources, region, implementation charges and service commitments are specified in your order. No inclusion or regional upgrade is implied by this overview.
A free trial workspace keeps its data in our EU region, and needs no card. If your contract names another country, email us the residency requirement and we'll come back with the region and the statement.