Hosting and government access
Last updated: 13th October 2026. This page should be read with your agreement with causaLens; if anything on it conflicts with that agreement, the agreement prevails.
This page describes where causaLens-hosted services run and the measures we use to protect non-personal data held in the EU against unlawful international governmental access. Personal data is also protected under applicable data-protection law.
Where we host
causaLens operates its hosted services on AWS, Google Cloud or Microsoft Azure in the location agreed for the deployment. The table below lists hosting locations. The local jurisdictions applicable to this infrastructure are the United Kingdom, Belgium and the United States, according to its location. Cloud providers may also be subject to legal obligations in other jurisdictions based on the entities operating the service.
| Provider | Region | Country |
|---|---|---|
| Amazon Web Services | eu-west-2 | United Kingdom |
| Google Cloud | us-central1 | United States |
| Google Cloud | europe-west1 | Belgium (EU) |
| Microsoft Azure | south-central-us | United States |
Model processing is separate from hosting. Hosted Digital Workers use approved model access provided by causaLens, or the customer's approved endpoints or credentials. Provider, processing region and retention terms are selected for each deployment. A hosting region does not by itself determine where model requests are processed. Gemini and Anthropic models on Vertex AI use global endpoints, which do not guarantee processing in a specific country or region.
| Service | Provider | Location |
|---|---|---|
| Model gateway | Amazon Web Services | AWS eu-west-2 (London, UK), operated by causaLens. Routes requests to the model services below. Logs are kept for 1 year, in line with our retention policy. |
| Gemini and Anthropic models (Vertex AI) | Google Cloud | Global |
| OpenAI GPT models (Azure Foundry) | Microsoft Azure | sweden-central (Sweden, EU) |
For Customer-Hosted Deployments, customers provide their own hosting and model services. Any separately agreed causaLens-hosted services, including agreed support processing, remain subject to the relevant hosting and data-protection arrangements.
Safeguards against unlawful third-country government access
- Technical: data is encrypted in transit (TLS) and at rest (AES-256), with keys managed in the cloud provider's key management service. Only a restricted number of staff can access production, through single sign-on, multi-factor authentication and role-based access. Access is reviewed every quarter. Security events are logged and monitored.
- Organisational: our security controls are independently audited annually. We run a formal risk assessment every year, review our security policies every year, and train all staff in security when they join and every year after.
- Contractual: we commit to protecting customer confidential information. If we are legally compelled to disclose it, we provide prompt prior written notice, where legally permitted, so the customer may seek a protective order or other appropriate remedy, and disclose only the portion we are legally required to disclose. These safeguards do not guarantee that lawful government access can never occur.
Questions: [email protected]