Data residency
HR software with EU data residency
Capstan is HR software that keeps your data in the EU. There is one live region today, with your records and files in Frankfurt and compute in Amsterdam, and it is a self-contained stack with no runtime path for your data to leave it.
The residency rule is written out on the security page, not left to a procurement questionnaire.
Where does Capstan host our data? In the EU.
Your data and object storage sit in Frankfurt and the compute that serves your workspace runs in Amsterdam, both inside the EU. This is the single region live today, and the footer on every page names it, because a region is listed only once it is actually serving your data.
- Data and files in Frankfurt, the eu-central-1 region.
- Compute in Amsterdam, the eu-west-1 region.
- The region is settled before you sign up, because the app you sign into is your region, and it does not change afterwards.
Can our data leave the region? No.
Each region is a self-contained deployment with no global control plane and no cross-region service key, so there is no runtime path out of it. Residency here is a property of where the database actually is, rather than a promise in a policy document.
- No shared control plane sitting above the regions that could read across them.
- No cross-region keys, because the per-region architecture never creates one.
- The same isolated stack is built to open in more regions later, and each new one is named only on the day it can hold your data.
What a data region actually is, and why where it sits matters more than a badge, is set out in this piece.
What about GDPR?
We do not hand you a compliance badge; we tell you where your data is and what we hold, and leave the compliance judgement to you and your advisers. Your data lives in the EU, it is encrypted under per-tenant keys, every sub-processor is listed and scoped to the region, and there is a data processing agreement you can read before you sign.
- The sub-processor register names every vendor, each one scoped to the live region.
- The data processing agreement is public, so you can review it before committing.
- How employee data sits under the GDPR, in plain terms, is in the GDPR and employee data guide.
Who inside Capstan can reach our data?
Nobody holds standing access. Our staff have no tenant of their own, and access to yours exists only while you have granted a time-boxed consent, masked by default and audited on both sides. Support access is the same residency question from the other end: not whether staff would look, but whether the system lets them without you switching it on.
- Access is granted by you, for a bounded window, and expires on its own.
- Sensitive fields are masked by default even during a granted session.
- Both sides of the access are logged, so there is a record of who saw what and when.
What certification do you hold?
The entity behind Capstan holds ISO/IEC 27001:2022, and the scope of what it covers is stated in full on the security page. We are equally plain about what we do not hold: there is no SOC 2 report, and the page says so rather than letting you assume otherwise.
- ISO/IEC 27001:2022, with the certified scope written out, not implied.
- No SOC 2 report today, and no claim of one. If SOC 2 is a hard gate for you, it is a fair reason to wait.
- Per-tenant encryption and database-enforced tenant isolation, described on the security page.
What happens to our data if we leave or a payment fails?
You can take a full export at any time, in open formats, and it keeps working even if a workspace is suspended for non-payment. Leaving never means losing your data, and a billing lapse never holds it hostage.
- One export of JSON and CSV with the original files and a documented manifest, initiated by an owner.
- The export sits outside the suspension check, so an unpaid workspace can still take its data and go.
- Deletion is cryptographic erasure followed by hard deletion, with a residue scan.
The full picture, including where the figures sit, is on the security page, and the price is one link away on pricing.
Start free for up to twenty people, with your data in the EU from the first hire.