EU hosting and data
Where Strike runs, subprocessors, retention, and cross-border transfers.
This page describes how Strike is hosted and what data crosses borders. It is not legal advice. For the privacy notice and legal notice, see strike-ai.eu/privacy and strike-ai.eu/legal.
Where we run
Hosted in the EU. strike-1 runs in France, the API and data in Belgium.
| Component | Location |
|---|---|
| Web app and API | Google Cloud Run, europe-west1 (Belgium) |
| Accounts, API keys and usage | Cloud SQL for PostgreSQL, europe-west1 (Belgium), via DATABASE_URL in production (SQLite is the local fallback only) |
| strike-1 inference | OVHcloud Gravelines (GRA11), France |
| Public edge | Cloudflare, Inc. (United States) proxies strike-ai.eu; TLS terminates at Cloudflare |
Cloudflare is a United States CDN and security subprocessor. It sees traffic in transit (including request bodies such as prompts), stores nothing for this purpose, and relies on the EU-US Data Privacy Framework and Standard Contractual Clauses. Do not assume EU-only processing.
Subprocessors
| Subprocessor | Role |
|---|---|
| Google Cloud EMEA Limited (Ireland) | Google Cloud platform (Cloud Run, Cloud SQL) |
| OVH SAS (France) | strike-1 model inference (Gravelines) |
| Cloudflare, Inc. (United States) | CDN, DDoS protection, TLS termination; traffic in transit only |
A data processing agreement (Art. 28 GDPR) is available on request. Contact: [EMAIL].
Decision API storage
By default, POST /v1/systemone does not retain request bodies.
When you send options.retain: true, Strike stores a hash plus a pseudonym for 30 days, not the prompt text. Delete earlier with DELETE /v1/retention/{request_id} using the same Bearer token.
Traces
strikeflow can export spans to POST /v1/traces. Decision spans include the question string in decision.metadata.question. Full context appears in decision.metadata.prompt only when TraceConfig.capture_content=True (default is false).
No server-side trace storage is deployed yet. Retention will be documented when it ships.
strike-1 context on the wire
Each decision sends your built context as state on /v1/systemone. That string is processed on the inference host in France. It is separate from trace export and from opt-in retain metadata.
Your responsibilities
- Classify whether your use involves personal data under GDPR.
- Use
retain: trueonly when you need kept metadata for debugging. - Rotate API keys and restrict console access.
Contact for privacy rights and DPA requests: [EMAIL].