Tag your traffic
Send a policy header — residency: EU — or set it per project in the dashboard. One line, zero code changes.
Residency-aware routing — new
Your data. Your jurisdiction. Your rules.
Where AI requests go is a legal question now. apiegg makes it a routing setting — tag your traffic with a jurisdiction, and the router keeps every request inside the lines.
How it works
Three steps to
Three steps to
jurisdiction-safe routing.
No new SDKs, no re-architecture. Residency is a policy your traffic carries — and the router enforces it.
apiegg routes in-region
The router only considers models and infrastructure that physically sit inside your rule. Best-fit matching still happens — just inside the lines. Nothing qualifies? The request fails closed — it never quietly leaves.
Get audit logs
Every request writes a residency record — where it went, which rule it satisfied. Proof for lawyers, auditors, and procurement teams.
The lay of the land
Eight jurisdictions.
Eight jurisdictions.
One dial.
Where the world's data-localization laws stand as of Nov 2026 — and what apiegg actually offers in each. No aspirational tiers: every card is statused.
✅ Live turn it on today — EU end-to-end; KZ data, records & fail-closed routing 📋 Policy tier routing policy + transfer documentation 🗺️ Roadmap not offered yet — demand reorders the map ✖ Not offered we track the law, we don't sell the route
European Union
✅ Live — end-to-end GDPR · Reg. 2016/679 · Arts. 44–49No blanket localization — but cross-border transfers need an adequacy decision, Standard Contractual Clauses, or Binding Corporate Rules, with post-Schrems II transfer impact assessments. In practice, EU enterprises increasingly demand EU-only processing in procurement.
How apiegg helps — with EU residency enabled, apiegg processes and stores your routing records inside EU member states and selects only model endpoints that commit to EU processing. Transfer documentation for GDPR Arts. 44–49 is generated from your audit log.
Kazakhstan
✅ Live Law No. 94-V "On Personal Data" · Art. 12(2), amended Jun 2026Personal data of KZ citizens must sit in a database physically in Kazakhstan — explicitly including electronic systems since 25 Aug 2026. Restricted-access data must even be collected and processed in-country, and cross-border transfer practically requires the subject's consent. The Digital Code (No. 255-VIII) adds controls on exporting processing outcomes.
How apiegg helps — Kazakhstan residency keeps your data and apiegg's routing records on infrastructure physically located in Kazakhstan. Requests flagged for KZ residency are served only by in-country model endpoints — if none is healthy, the request fails rather than leaving the country. Your audit log is the evidence.
Russia
✖ Not offered Federal Law No. 152-FZ · Art. 18(5) · tightened by 23-FZ, 1 Jul 2025Russian citizens' personal data must be recorded and stored in databases located in Russia — now framed as a prohibition on foreign databases for the initial collection. Cross-border transfers need prior notice to Roskomnadzor. Enforcement is hard: LinkedIn was blocked; fines reach ₽18M (up to 3% of turnover for repeat leaks) — and the rule reaches foreign companies serving Russian users.
Where apiegg stands — not offered. No Russia-hosted model pool sits behind this router, and we don't sell Russia residency. The card stays as landscape knowledge: the rule reaches foreign operators serving Russian users, and your counsel should know it.
China
✖ Not offered PIPL + Cybersecurity Law (Art. 39, amended, eff. 1 Jan 2026) + DSLCIIOs and key sectors must store personal data and "important data" on mainland servers. Outbound transfers are tiered: <100k individuals exempt; 100k–1M → China SCCs or certification; ≥1M (or ≥10k sensitive) → CAC security assessment. Remote access from abroad counts as an export. Penalties reach ¥50M or 5% of turnover (Didi: ¥8.03B).
Where apiegg stands — not offered. apiegg routes to no mainland-China infrastructure today and doesn't sell China residency. The card stays because the outbound-transfer tiers are worth knowing before your lawyers ask.
Vietnam
🗺️ Roadmap Cybersecurity Law + Decree 53/2022 + Data Law 60/2024 + PDPL (Law 91/2025)In-scope online service providers must store specified user data in Vietnam (min. 24 months); personal-data originals stay in-country, with transfer impact assessments filed to authorities. Core and important data face strict export controls — and non-compliant platforms can be blocked.
Where apiegg stands — Vietnam residency is on our roadmap; we do not currently offer it. Need it sooner? Tell us — demand reorders the map.
Indonesia
🗺️ Roadmap GR 71/2019 + PDP Law No. 27/2022Hard localization applies to public-scope electronic system operators (data centers in-country); private operators may store abroad under conditions, while the financial sector (OJK) must keep primary data centers domestic. The PDP Law has been fully enforced since 17 Oct 2024.
Where apiegg stands — Indonesia residency is on our roadmap; we do not currently offer it.
Saudi Arabia
📋 Policy tier PDPL (Royal Decree M/19) · Art. 29 + Transfer Regulation + SAMA rulesNot a blanket ban — but every transfer abroad needs a permitted purpose, national-security check, and equivalent protection (SDAIA SCCs; no adequacy list published yet). Sensitive data at scale requires risk assessments, and SAMA keeps financial data physically in-Kingdom.
⚠ Draft amendment (Oct 2026 consultation) would add general in-Kingdom storage.
How apiegg helps — Saudi residency applies a KSA-only routing policy on request; your audit log documents every flow for PDPL Article 29 assessments. In-Kingdom hosting tiers will follow the Kingdom's cloud-region expansion.
Turkey
📋 Policy tier KVKK (Law No. 6698) · Art. 9 · amended 2024Cross-border transfers are allowed only via an adequacy decision, appropriate safeguards (SCCs/BCRs), or binding rules — no free flow.
How apiegg helps — Turkey residency applies a Türkiye-only routing policy on request and produces the request-level records that support your Article 9 transfer file (e.g., KVKK standard-contract notification).
…and anywhere else
Residency isn't a checklist, it's a dial. Tell apiegg your jurisdiction (or your customer's), and the router enforces it. New rules get added as they land — the map-making is the moat.
GDPR-style custom policies supported — bring us the rule, we bring the route.
Good questions
Before the lawyers ask.
No. ⚖ apiegg gives you routing controls and evidence — your counsel certifies compliance. We ship the rails; your lawyers sign the letter.
Tell us the jurisdiction. We'll build a custom residency policy for it — GDPR-style custom rules are already supported, and new jurisdictions land as regulators write them.
No. Same endpoint, same latency budget — the router simply narrows the candidate pool to in-region models before picking the best fit. Policy-aware routing happens in the same milliseconds as every other routing decision.
Probably not. Most customers route globally and never think about this page. Residency mode is there for the day a deal, a lawyer, or a law says so.
Early access
Make compliance
Make compliance
a routing setting.
Point your agents at one endpoint — and decide exactly where their requests are allowed to land. Dozens of models, two API dialects, any jurisdiction.
✨ Free during early access · no credit card
⚖ Legal summaries are informational, current as of Nov 2026, and not legal advice. Laws change — verify with qualified counsel.
🥚 Zero retention, stated honestly: apiegg does not persist your request or response content. Zero retention also depends on each model provider's policy — where a provider retains flagged content for abuse monitoring, that exception is stated in our endpoint catalog.