EU hosting and data: Strike docs

This page describes how Strike is hosted and what data crosses borders. It is not legal advice. For the privacy notice and legal notice, see strike-ai.eu/privacy and strike-ai.eu/legal.

Where we run

Hosted in the EU on OVHcloud Gravelines (GRA11), France.

Component	Location
Web app and API	OVH Public Cloud, GRA11 (France), `strike-app-1`
strike-1 inference	OVH Public Cloud, GRA11 (France), GPU instance
DNS	OVHcloud
Accounts, API keys and usage	PostgreSQL on Google Cloud SQL, europe-west1 (Belgium), via encrypted `DATABASE_URL` from the OVH app (cutover to OVH-managed DB planned)
TLS	Let’s Encrypt on the OVH app host (Caddy)

Subprocessors

Subprocessor	Role
OVH SAS (France)	Web, API, inference, DNS
Google Cloud EMEA Limited (Ireland)	PostgreSQL (Cloud SQL) until database cutover

A data processing agreement (Art. 28 GDPR) is available on request. Contact: [EMAIL].

Decision API storage

By default, POST /v1/systemone does not retain request bodies.

When you send options.retain: true, Strike stores a hash plus a pseudonym for 30 days, not the prompt text. Delete earlier with DELETE /v1/retention/{request_id} using the same Bearer token.

Traces

strikeflow can export spans to POST /v1/traces. Decision spans include the question string in decision.metadata.question. Full context appears in decision.metadata.prompt only when TraceConfig.capture_content=True (default is false).

No server-side trace storage is deployed yet. Retention will be documented when it ships.

strike-1 context on the wire

Each decision sends your built context as state on /v1/systemone. That string is processed on the inference host in France. It is separate from trace export and from opt-in retain metadata.

Your responsibilities

Classify whether your use involves personal data under GDPR.
Use retain: true only when you need kept metadata for debugging.
Rotate API keys and restrict console access.

Contact for privacy rights and DPA requests: [EMAIL].