Data residency
Where every kind of data lives today, and what never crosses a region.
Cells and regions
An organization is pinned to exactly one regional cell by its jurisdiction. Ciresk CI runs in one cell today: eu1 in AWS eu-central-1, answering on ci.eu.ciresk.com; there is no cell outside the EU. Everything with content (source deltas, logs, artifacts, caches, test results) stays in the cell. Identity, API key records and routing are the shared Ciresk control plane and hold no build content. A credential minted for another region is refused with 421 wrong_region before any query.
| Crosses regions | Never crosses |
|---|---|
| Identity, organization placement, API key records, monthly usage totals | Source, diffs, logs, artifacts, caches, test results, worker metadata with paths |
What data stays where
| Data | Where it lives |
|---|---|
| Identity | WorkOS, through the Ciresk platform; WorkOS stores identity data in the US |
| Organization placement, API key records | The Ciresk platform (api.ciresk.com) |
| Job metadata, the journal, policy, audit rows | The cell's Postgres in eu-central-1, encrypted with the cell's KMS key |
| Source deltas, cache entries, logs, artifacts, test results | The cell's object store in eu-central-1, under your organization's prefix, encrypted with the cell's KMS key. This holds when your jobs run on your own workers too: the cell mints the presigned URLs workers upload to and download from, and they point into the cell's bucket. |
| Source mirrors and warm workspaces | The disks of the workers that run your jobs |
Deploy secrets, pass_env values (never a git credential) | Your workers' secrets backend; only pass_env names reach the cell |
| Worker binaries for updates | The cell's release/ prefix, served from get.ciresk.com |
Running the control plane or the object store in your own network is not available yet.
Your workers' egress proxy runs in audit mode by default: a task can reach a host outside your organization's allowlist, and every such host is recorded on the job. Block mode is a policy setting; see Egress.
Retention
Ages count from the job's creation. The three *_retention_days fields are policy: an organization admin reads them with ciresk ci policy get and changes them for the organization or one repository with ciresk ci policy set (log_retention_days, artifact_retention_days, job_retention_days, 1 day to 10 years).
| Data | Retention |
|---|---|
| Logs | 90 days (log_retention_days); the log objects themselves expire from the store after 90 days. |
| Artifacts | 30 days (artifact_retention_days), rows and objects. |
| Test results | Passed results 30 days, as their report artifact; failed, flaky and skipped results 90 days, as the log they point into. |
| Job events | Moved to an archive in the store after 90 days (job_retention_days); the archive expires after 13 months. |
| Jobs and tasks | Deleted 13 months after the job's creation, with their remaining rows and the job events archive, or later when the repository keeps its job events, logs, artifacts or cache hits longer. A job still running, or one a schedule, a part or a toolchain pack names, stays. ciresk ci repos delete removes a repository's logs, artifacts, cache entries and the blobs only it references, and keeps its jobs as tombstones, which are deleted after job_retention_days. |
| Cache entries | Kept until the repository is deleted. |
| Audit rows and the budget ledger | Kept; the cell has a retention period for each, and none is set yet. Export is not available yet. |
| Old object versions | Expire 30 days after they are replaced or deleted. |
| Database backups | 14 days of automated backups with point-in-time recovery, in the cell's region. |
Leaving Ciresk CI
What you can remove yourself, in this order:
| Step | Command or place |
|---|---|
| Each repository and everything only it references: logs, artifacts, cache entries, blobs | ciresk ci repos list, then ciresk ci repos delete <repo_...> (an organization admin; it asks first, --yes for scripts). Jobs stay as tombstones and the deletion is an audit row. |
| Your own workers | ciresk ci workers remove <name> drains, deregisters and, on its own host, uninstalls the worker. |
| API tokens | platform.ciresk.com under API tokens: Delete token stops it everywhere within 30 seconds. |
| The CLI's stored sign-in | ciresk ci auth logout on each machine; then remove ~/.ciresk. |
Deleting the organization itself, its remaining job tombstones and audit rows is not self-service: write to [email protected] from an owner's address. Replaced or deleted objects expire from the store's version history 30 days later, and database backups roll off after 14 days.
Identity
Identity is hosted by WorkOS, which stores identity data in the US; identity holds no source or build content.