![Logo landing page 232x64 with border.png]](https://support.safetica.com/hs-fs/hubfs/Marketing/Safetica_logo_/Logo%20landing%20page%20232x64%20with%20border.png?width=145&height=40&name=Logo%20landing%20page%20232x64%20with%20border.png){kind=logo}
Introduction
To enhance performance and meet customer needs, we have introduced three data centers: in the US, in the EU, and in Brazil. This expansion helps to meet regulatory requirements, improve response times, and ensure data stays within the customer’s region.
In this article, you will find answers to questions related to:
Data center location
Q: Where are Safetica Platform's data centers located? Where will my data be processed?
A: The Safetica Platform is currently hosted in Azure data centers located in the European Union and the United States. Therefore, it follows all the security standards of Azure. The specific data center locations are:
- EU data center: West Europe
- US data center: West US 2 (Washington state)
- BR data center: Brazil South (Sao Paulo)
Q: Where in Safetica can I configure which data center to use?
A:
✨Safetica Platform: Safetica partners can select the data center location when registering a new customer in Safetica Partner Portal.
The data center location for Safetica Cloud Protection will be pre-selected based on the choice in Safetica Partner Portal:
- For a US data center: US data center
- For an EU or BR data center: EU data center
💻Safetica On-Prem: The data center location for Safetica Cloud Protection can be chosen manually. You can select from the US data center and the EU data center. For customers in LATAM, we recommend using the EU data center.
Q: Which data center should I choose?
A: The best practices for Safetica partners when registering a new customer in Safetica Partner Portal:
For the US and North America: Use the US data center.
For Europe: Use the EU data center.
For Latin America: Use the BR data center.
If you are not sure, select the EU data center.
✍️ Data residency:
For US customers (i.e., those that select the US data center): All data processing and data at rest remain solely within US datacenters.
For EU customers (i.e., those that select the EU data center): All data processing and data at rest remain solely within EU datacenters.
Q: Can I use a different data center for processing my Microsoft 365 tenant data than for Safetica?
A: The location of the M365 tenant data center is fixed based on the location chosen in Safetica Partner Portal:
- For a US data center: US data center
- For an EU or BR data center: EU data center
Failover, database backups, and service availability
Q: If the US data center goes down, does it fail over to the EU or BR data centers?
A: No. Each customer environment runs in a single data center region without cross-region failover. However, Safetica is not connectivity-critical - Safetica Clients continue enforcing policies locally and synchronize automatically once the server is restored.
Q: Do you have failover, disaster recovery, or redundancy?
A: Safetica does not offer customer-facing disaster recovery or self-service failover. However, several mechanisms protect your data and services:
- Database backups: Safetica maintains backups of customer databases for the last 30 days, restorable on request through Safetica Support. Deleted items also remain in the trash for 30 days.
- Azure geo-redundancy: Safetica Platform runs on Microsoft Azure, which includes built-in geo-redundant disaster recovery in a geographically separate data center. If the primary data center fails, Azure can fail over to the secondary one. This is standard Azure infrastructure, not a Safetica-specific feature.
- Security services failover: Safetica's cloud-hosted security services can failover to another server within Azure infrastructure during an outage. Data synchronizes back once connectivity is restored.
- Safetica Client resilience: Safetica Client caches all policies locally. Server downtime does not leave devices unprotected - protection continues offline and events synchronize automatically when the connection is restored.
Note: This is not customer-facing disaster recovery. Customers cannot switch between data centers themselves.
Q: What is the service availability of the data center?
A: Availability depends on Microsoft Azure’s infrastructure. The availability of Safetica Platform is closely tied to Azure’s uptime.
Q: Can you restore my data if something goes wrong?
A: Yes. Safetica keeps backups of customer databases for the last 30 days. If a customer needs a restore within that window, please contact Safetica Support. Deleted items also remain in the trash for 30 days before permanent removal.
Migration between data centers
Q: Can I migrate Safetica between the EU, US, or BR data centers?
A: Yes, migration is possible but requires manual developer intervention. Please contact Safetica Support for assistance.
❗Please note: If you have a Microsoft 365 tenant added to Safetica, it will remain in its original data center. Customers themselves must manually migrate their M365 tenant.
Q: How do I migrate my Microsoft 365 tenant to another data center?
A: Based on the location chosen in Safetica Partner Portal, the M365 tenant must be in the following data center:
- For a US data center: US data center
- For an EU or BR data center: EU data center
To migrate:
- Migrate Safetica with the help of Safetica Support.
- Manually deactivate the whole M365 integration:
- Deactivate Outlook protection, including deactivating the Outlook add-in. Learn more.
- Deactivate Exchange protection, including the relevant mail flow rule set up in Exchange. Learn more.
- Deactivate SharePoint protection. Learn more.
- Remove the M365 tenant. (In Safetica console, go to Integrations (Cloud services), click your tenant, scroll to the bottom of the page, and click Remove tenant).
- Add the M365 tenant again and choose the desired data center. Learn more.
Migration from Safetica On-Prem to Safetica Platform
Q: Can On-Prem customers migrating to Safetica Platform choose which data center to use?
A: Yes, they can choose between the EU, US, and BR data centers.
Future expansion
Q: Will Safetica add more data centers in other regions?
A: Yes, additional regions are under consideration, based on customer demand.
Technical details
Q: How do you ensure customer data stays in the correct region?
A: All operations occur within the selected data center. Data is only transferred between regions when necessary. The only exception is when an admin accesses data from another region—in such cases, only processed results are transferred, not raw data.
Q: If an EU customer travels to the US, and Safetica Client sends a request from the US, where will their data be processed?
If an EU customer travels to the US, their traffic goes to the US data center, but then it is immediately sent to the EU data center, where it is processed.
Q: If a US customer travels to LATAM, and Safetica Client sends a request from LATAM, where will their data be processed?
A: If a US customer travels to LATAM, their traffic goes to the BR data center, but then it is immediately sent to the US data center, where it is processed.
Q: If I use a US/EU/BR data center and travel abroad, will my data route through the closest center?
A: No, your traffic will be routed back to your designated data center.
Q: Will you collect, process, store or transmit our data?
Safetica Platform collects, processes, stores, and transmits data related to the customer's environment as part of delivering the data loss prevention service. The scope of data collected is determined by the policies and features the customer enables. Endpoint agents communicate with the Safetica cloud infrastructure, and all transmission is encrypted using TLS 1.2/1.3.
Q: What data is stored and for how long?
Safetica Platform stores the following categories of data: endpoint and device information (computer name, username, operating system, agent version, device identifiers); user and organizational information (users, groups, departments, directory data synced from the connected identity provider); DLP activity and event logs (file operations, transfers, uploads, emails, removable-media activity, printing, web activity, and other operations depending on enabled policies); file metadata (file name, path, size, type, associated user, application, and destination); policy configuration (DLP rules, data classifications, exceptions, and actions); incident records (detected policy violations with timestamps, users, devices, channels, and enforcement actions); and administrative audit logs (administrator activities and configuration changes).
Depending on the features and policies enabled, Safetica may inspect file content to identify sensitive information. When in-cloud content analysis is used, the file is deleted immediately after analysis and Safetica does not retain a copy of the file. Documents themselves remain on the endpoint.
Data retention depends on the product plan: up to 12 months (Standard), 24 months (Premium), or 36 months (Enterprise). Cloud database backups and deleted items are retained for 30 days.
Q: Where will it be stored?
Safetica Platform is hosted on Microsoft Azure. Three data center regions are available: EU (West Europe – The Netherlands), US (West US 2), and BR (Brazil South). The customer selects the region during onboarding, and once selected it cannot be changed. All data processing and data at rest remain within the selected region.
Q: Who will have access to this data?
Access to customer data within the Safetica console is governed by role-based access control. Three administrator roles are available: Auditor (read-only access across all areas), Admin (full access with the ability to change settings), and Custom (individual permissions selected manually). All administrator activities are recorded in the Admin trail. Console single sign-on uses Microsoft Entra ID.
Access by the Safetica partner managing the customer's environment is subject to the customer's agreement with that partner. Safetica's internal access to customer environments is governed by strict access controls, role-based permissions, and the principle of least privilege as part of Safetica's ISO 27001-certified information security management system.
Q: Can we control what data is sent to the cloud?
The data Safetica collects is determined by the policies, features, and channels the customer enables. Administrators control which DLP channels are active (email, cloud drives, removable media, printing, web, instant messaging, and others), which data classifications are applied, and whether features such as Data Discovery or in-cloud content analysis are turned on. Only activity matching the enabled policy scope generates event data that is transmitted to the cloud. Data Discovery scope is also configurable, and external hard drives, USB drives, network shares, cloud drives, virtualized drives, and system folders are excluded by default.
Q: Will the data be encrypted at rest and in transit?
Yes. Data in transit between Safetica Client and the Safetica Platform is encrypted using TLS 1.2/1.3. Data at rest in the cloud environment is encrypted using Microsoft Azure's infrastructure encryption. Communication between the SEC and the SMS/platform is encrypted in the same way.
Vendor security practices
8. Do you perform independent pentesting?
Safetica conducts regular security testing as part of its information security program.
9. Do you follow an SSDLC?
Safetica follows a secure software development lifecycle aligned with industry best practices. Security is integrated throughout the development process, including design review, code review, and security testing prior to release.
10. Any security incidents or breaches in the last 5 years?
Safetica takes security seriously and maintains an active vulnerability management program. In 2025 and 2026, two vulnerabilities were identified in the Safetica Client kernel driver (ProcessMonitorDriver.sys), publicly disclosed as CVE-2025-70795 and CVE-2026-0828, and remediated through updated client releases. Both vulnerabilities were addressed promptly, and detailed remediation guidance was published in the Safetica Knowledge Base.
11. Are any third parties involved in delivering your service?
Yes. Safetica Platform is hosted on Microsoft Azure and relies on a number of third-party services in delivering the product. Key third parties include Microsoft Azure for cloud infrastructure and hosting, Microsoft Entra ID for identity and authentication, and Azure OpenAI for AI-driven classification features (operating under an enterprise agreement where customer data is not exposed outside the secured environment and is not used to train AI models).
Legal documents
You can find all the legal documents, terms and conditions that apply to your relationship with Safetica and usage of Safetica solutions here.