Status: accepted · Date: 2026-11-13 · Deviates from: ARD "Hetzner in Germany" · Implements: RNF07 as far as the platform allows
Enforcement: [manual] the Neon project region (aws-eu-central-1) and R2 jurisdiction are checked in pnpm setup output and docs/STATUS.md · [convention] Hyperdrive caching stays off (ADR-0009).
Context
The product promises "data in the EU (Germany)". The template deploys one Cloudflare Worker with Neon Postgres and R2.
Decision
- Database: Neon in
aws-eu-central-1(Frankfurt). All personal data at rest lives there. Backups stay in the same region. - Files: R2 bucket created with the EU jurisdiction (
wrangler r2 bucket create <name> --jurisdiction eu). - Compute: Workers run at the edge nearest the caller; with Smart Placement the Worker tends to run near Frankfurt because the database is there. Cloudflare's Data Localization Suite (Regional Services, EU) can pin TLS termination and processing to EU data centres; it is an Enterprise add-on, recorded as
[TBD]cost. - Trade-off, stated honestly: without Regional Services a request from a traveller in São Paulo may be processed in Brazil before the data is stored in Frankfurt. Data at rest is in Germany; data in transit and in memory may not be. Before the beta, legal review decides whether Regional Services is required (
[TBD]indocs/STATUS.md). - Subprocessors keep the ARD list with Hetzner replaced by Cloudflare, Inc. (compute, R2) and Neon, Inc. (database, Frankfurt).
Provisioned (2026-11-13)
Neon project bjj-travel in aws-eu-central-1, R2 bucket bjj-travel-files with --jurisdiction eu, Hyperdrive bjj-travel-db with caching disabled, Worker placement aws:eu-central-1. Regional Services remains [TBD].