Skip to content

Data residency & subprocessors

Venturi uses a dedicated, single-tenant data plane and a separate control plane. The data plane runs either in your cloud account (self-hosted) or in a Venturi-operated, single-tenant environment pinned to your contracted residency lane (SaaS). This page describes the boundary, region pinning, provider connectors, and subprocessors for both modes.

Where your data lives

Your data stays in the contracted tenant boundary

In self-hosted mode, per-tenant data stays in your cloud account. In SaaS mode, it stays in the dedicated Venturi-operated tenant environment and residency lane named during onboarding. Neither mode pools operational data with another tenant. See Deployment modes.

The published customer-side onboarding modules target AWS, Azure, and GCP: they are real IaC modules your own security team reviews before deployment. (Venturi’s own internal development footprint is a single, env-separated account, distinct from the customer-deployable artifact.) See the onboarding guides for each cloud.

Control-plane and aggregation residency

The Venturi control plane runs region-pinned. EU-origin data, including opt-in anonymized telemetry, is processed in-region or under GDPR Chapter V safeguards (Standard Contractual Clauses), never silently routed cross-region. Venturi’s residency stance is single region plus SCCs.

Cross-tenant aggregation residency

The cross-tenant Aggregation environment is a separate, Venturi-managed VPC that no tenant data plane can read, and it is region-pinned from day one: region pinning of aggregation is a present architectural property, not a deferred milestone.

  • De-identification before egress. All tenant-identifying attributes are anonymized before any data leaves the dedicated tenant data plane; the training pipeline reads only from the aggregation environment, never from tenant data planes.
  • Per-jurisdiction residency filtering. EU tenants do not contribute to non-EU aggregations, and vice versa.
  • Consent-gated. Aggregation is off by default for general-availability customers and requires explicit, scoped, revocable permission.

See Tenant isolation for the full aggregation model.

Region-aware processing

The canonical event schema carries a region field, and deployment carries a data-center-region configuration, enabling region-aware processing and residency filtering. A full, discrete customer-facing residency-control surface (inference_geo) is on the roadmap, built atop these region-aware fields and the per-jurisdiction filters. See Compliance.

Provider connectors

Venturi enriches attribution from provider-account reporting where you supply the credentials. Every connector is read-only.

Connector Read-only Notes
GitHub / Okta / cloud billing Yes Read-only org/team/billing metadata polling.
Anthropic admin-key usage/cost Yes (by API contract) Requires your admin key; not available on Claude-on-AWS / Amazon Bedrock.
OpenAI admin-key / audit logs Yes (by API contract) Requires your organization-owner access and audit logging enabled in OpenAI Data Controls.
Workspace opt-in router n/a Default state: nothing is ingested until an organization owner explicitly opts a workspace in.

Your admin key never leaves your trust boundary

Provider admin keys are stored per-tenant, KMS-encrypted, inside your trust boundary; the Venturi control plane never observes one in plaintext. Connectors use the keys only for documented read endpoints, and nothing is ingested until you explicitly opt a workspace in. Within an opted-in workspace, your provider’s own RBAC still governs visibility: Venturi does not collect data your admin is not already entitled to see in the provider console.

Subprocessors

Because each data plane is single-tenant and the control plane carries no raw tenant data, Venturi’s subprocessor surface is intentionally minimal.

Subprocessor Role
Data-plane cloud provider In self-hosted mode, your provider under your agreement. In SaaS mode, the provider and region named in the tenant’s controlled subprocessor inventory.
Venturi control-plane endpoints The signed pricing-catalog sync, the software-release check, and (opt-in) anonymized telemetry.
Research / training tooling Used only for the consent-gated Aggregation VPC, for customers who opt in to de-identified aggregation.

The authoritative, versioned inventory for an onboarded customer is a controlled artifact in the tenant Trust Center → Data processing → Subprocessors. It names each applicable vendor, purpose, data categories, processing region, and transfer safeguard. It is included in the onboarding diligence pack because the exact list depends on deployment mode, region, and enabled connectors.

Each proposed addition is risk-assessed before data flows. Affected customers receive the Article 28(2) change notice and contractual objection window. The public page describes the disclosure mechanism; the tenant artifact is the authority for actual vendors and regions.