Data residency and personal data

A workspace can limit where its data is processed. There are three controls, in two places:

Control	Where	Who can change it
Data residency policy	Admin console, Workspace page	Owner
EU-hosted models only	Edit workspace, under Data & model region	Owner
Personal data: ZDR only	Edit workspace, under Data & model region	Owner turns it on; only your platform operator turns it off

ZDR means zero data retention: the model provider does not keep the content of a request after answering it.

The data residency policy

The policy says where the workspace's inference, embeddings and integration traffic are allowed to happen. Open the Admin console's Workspace page and find Data residency.

A strip at the top shows the policy in force, for example "Requires: EU, ZDR, Enforcing", or "No policy (advisory off)".

The three fields

• Required region. A requirement is met by any region contained in it: UK counts as EU. A specific AWS region only matches itself. "No region requirement" removes the region rule.
• Require zero-data-retention (ZDR). A separate rule. A region does not imply a retention posture: a US connection can be ZDR and an EU one can be non-ZDR.
• Enforce this policy.
  • Off is Advisory: the policy is shown on every integration and connection but nothing is refused.
  • On is Enforcing: inference, embeddings and integrations that do not meet the policy are refused unless a workspace admin grants an audited override.

Preview, then save

Tightening a policy has effects beyond the page, so Save stays disabled until you press Preview impact for exactly the values on screen. Any edit clears the preview.

The preview changes nothing. It reports:

• how many integrations would move to awaiting approval, how many would be released and how many are unchanged, with a row for each;
• how many existing overrides would need granting again, and how many would stop mattering;
• how many connections stay eligible for inference, before and after.

When the preview finds a blocking consequence, a Type enforce to confirm field appears and Save needs the word enforce. The most important blocking case is a platform default inference connection that does not meet the policy: routing, summaries and key points would stop for the workspace.

Saving never revokes an override. Every policy change is written to the audit log with its before and after values.

If someone else changed the policy while you were editing, Save asks you to preview again.

Overrides on file

Below the policy, Overrides on file lists the workspace's live exceptions: the rule each one covers, the integration, the basis, who approved it, when, and when it expires.

• An Admin or Owner can Revoke an override here.
• Granting happens in the integration's own drawer on the Integrations page, where the unmet rule is known.

EU-hosted models only

Off by default. When it is on, the workspace uses EU-hosted models only: chat, embeddings and image generation must run on an EU connection, or the request is refused with a clear reason. The AI Designer agent is hidden when no EU image connection exists.

Personal data: ZDR only

Off by default. When it is on, every model call in the workspace runs on AWS Bedrock in the EU with zero data retention, or is refused before it runs. There is no fallback. That covers chat, agents, routing, moderation, summaries, titles, findings, embeddings, images and interviews.

• An Owner can turn it on. If the platform's default inference or embeddings connection would not meet the rule, the switch warns you first and offers Turn it on anyway.
• Only your platform operator can turn it off.
• Each change is written to the audit log.

Your platform operator can lift the EU and ZDR model rules for every workspace for a limited time. While that is in force, the switch shows a notice saying the setting is not enforced (embeddings still follow it).

Images

An image in a message goes only to a model connection marked ZDR. When the agent's connection is not, the image is held back and one approval card asks whether to send it anyway. There is no workspace setting for this; your platform operator marks which connections are ZDR.

Choosing a model that meets the rules

The model list in the agent editor has region and capability filters and a ZDR only tick box. See Choosing a compliant model.

What your platform operator controls

These are not visible to a workspace admin:

• the content scan that checks what agents read from outside the workspace;
• the temporary platform-wide lifting of the EU and ZDR rules, and which providers it never covers;
• which connections are marked ZDR, and the platform's default inference connection.