# EU hosting on Cloudflare Workers and Neon (Frankfurt)

The repository's architectural decision, rationale and consequences.

# EU hosting on Cloudflare Workers and Neon (Frankfurt)

**Status:** accepted · **Date:** 2026-11-13 · **Deviates from:** ARD "Hetzner in Germany" · **Implements:** RNF07 as far as the platform allows

**Enforcement:** `[manual]` the Neon project region (`aws-eu-central-1`) and R2 jurisdiction are checked in `pnpm setup` output and `docs/STATUS.md` · `[convention]` Hyperdrive caching stays off (ADR-0009).

## Context [#context]

The product promises "data in the EU (Germany)". The template deploys one Cloudflare Worker with Neon Postgres and R2.

## Decision [#decision]

- **Database:** Neon in `aws-eu-central-1` (Frankfurt). All personal data at rest lives there. Backups stay in the same region.
- **Files:** R2 bucket created with the EU jurisdiction (`wrangler r2 bucket create <name> --jurisdiction eu`).
- **Compute:** Workers run at the edge nearest the caller; with Smart Placement the Worker tends to run near Frankfurt because the database is there. Cloudflare's Data Localization Suite (Regional Services, EU) can pin TLS termination and processing to EU data centres; it is an Enterprise add-on, recorded as `[TBD]` cost.
- **Trade-off, stated honestly:** without Regional Services a request from a traveller in São Paulo may be processed in Brazil before the data is stored in Frankfurt. Data at rest is in Germany; data in transit and in memory may not be. Before the beta, legal review decides whether Regional Services is required (`[TBD]` in `docs/STATUS.md`).
- **Subprocessors** keep the ARD list with Hetzner replaced by Cloudflare, Inc. (compute, R2) and Neon, Inc. (database, Frankfurt).

## Provisioned (2026-11-13) [#provisioned-2026-11-13]

Neon project `bjj-travel` in `aws-eu-central-1`, R2 bucket `bjj-travel-files` with `--jurisdiction eu`, Hyperdrive `bjj-travel-db` with caching disabled, Worker placement `aws:eu-central-1`. Regional Services remains `[TBD]`.