Understanding Where Your Data Lives
Security and data residency are critical concerns for any enterprise deploying AI. This lesson summarizes the published architecture as a starting point for verifying where data resides and how it is protected in your deployment.
The Default Stack
The published default architecture describes the following stack; verify which components and safeguards apply to your deployment:
| Component | Provider | What It Hosts |
|---|---|---|
| Core Application & Tenants | Google Cloud Platform (GKE) | The platform, control plane, harness, database, and n8n workflow engine |
| Frontier Models (LLM) | OpenAI Enterprise Agreement | Vertically integrated frontier models for reasoning and generation |
| Vector Store | OpenAI Enterprise Platform | Document embeddings encrypted with AES-256 at rest |
| Traffic Protection | Cloudflare WAF | DDoS mitigation, bot management, and traffic filtering |
Tenant Isolation
The published default architecture describes an isolated namespace within Google Kubernetes Engine (GKE) for each customer organization. Verify the following isolation details for your deployment:
- Your data is logically separated from other customers
- Each agent has its own independent Vector Store, configuration, and access controls
- API keys exist at agent and organization level — check each operation's schema for which credential it requires, and revoke any compromised key immediately
- Conversation data is isolated per thread and per agent
Encryption Standards
| State | Standard | Details |
|---|---|---|
| Data at Rest | AES-256 | Published default: documents, embeddings, and conversation logs; verify deployed scope |
| Data in Transit | TLS 1.2+ | Published default: API calls, webhook payloads, and user interactions; verify each configured data path |
| Deployment review | Confirm scope | Verify encryption requirements for each configured endpoint, integration and data store with your administrator. |
Data Retention
- During agreement: Data is retained for the duration of your contract
- After termination: Confirm deletion timing, backup handling and exceptions in the agreement that applies to your organization.
- Compliance: GDPR and CCPA aligned — supports right-to-deletion requests
Extensibility: Bring Your Own
While the default stack is optimized for most deployments, raia supports enterprise extensibility:
- External Vector Stores: Connect your own vector database (Pinecone, Weaviate, etc.) via integration
- Other LLM Providers: Use alternative models (Anthropic, Google Gemini, etc.) via integration configuration
- Custom hosting: For regulated industries requiring specific data residency, discuss dedicated deployment options with your account team
Security Controls Available in the Launch Pad
| Control | Location | Purpose |
|---|---|---|
| Agent-Secret-Key | Agents → your agent → Skills → API → Edit → Create API Key | Per-agent API authentication |
| IP Whitelist | Security tab — confirm the exact location in your account | Restrict access to specific IP addresses |
| Security Key | Security tab — confirm the exact location in your account | Require a token to access the Live Chat widget |
| Geographic Restrictions | Security tab — confirm the exact location in your account | Block access from specific countries/regions |
| Role-Based Access Control | Organization settings | Product-specific roles. In raia CX the organization owner is Org Owner, and Invite User offers Org Admin, Org Manager, Org User, Copilot Admin, Copilot User and Guest. Agent roles (Agent Owner to Agent User) are a separate layer. See Roles & Permissions. |
Key Takeaway: Confirm hosting, encryption scope, isolation, retention and deletion terms for your deployment. Published architecture descriptions are not evidence that every integration or customer agreement has the same safeguards. See the Trust Center and record the applicable agreement and verification evidence.