# Where is my data stored?

> Your database and files live on your instance's VM in the region you picked, and backups go to a private bucket in the same region. Which regions exist and which services touch your data.

Source: https://supahost.app/kb/data-location · Updated 2026-11-11

Your data lives on your own instance: a VM in the region you chose when you created it. Each project's Postgres database and its Storage files sit on that VM's disk, and daily database backups go to a private storage bucket in the same region. The region can't be changed after the instance is created, so choose it with your users and any data-residency rules in mind.

## Regions

| Area | Regions |
|---|---|
| North America | US Central, US West, US East |
| Europe | Belgium, London, Frankfurt |
| Asia-Pacific | Singapore, Sydney, Tokyo |

The **Instance** page and each project's **Overview** show the region.

## Where each kind of data is kept

| Data | Location |
|---|---|
| Database (tables, Auth users, policies) | Postgres on your instance's VM |
| Storage files | the VM's disk (not in the database backups) |
| Daily backups and WAL for point-in-time recovery | a private bucket in the instance's region |
| Project keys and JWT secret | Google Cloud Secret Manager |
| OAuth client secrets and function secrets | Vault, inside your project's database |
| Edge Function source | SupaHost's platform database and your instance's backup bucket |
| Exports you create | on the instance, behind a download link that lasts 24 hours |

SupaHost runs on Google Cloud: instances are Compute Engine VMs, each one used by a single customer.

## Services that see some data in transit

- **Auth emails** (confirmations, magic links, password resets) go through Resend, sent from `noreply@supahost.app`. They include the recipient's email address and the link or code.
- **Edge Functions** you write can send data wherever your code sends it.
- **The MCP `search_docs` tool** sends the search text to Supabase's docs search; it doesn't send your data.

## Example: checking from SQL

Everything for a project is in one database you can inspect:

```sql
select current_database(),                     -- p_app_one
       pg_size_pretty(pg_database_size(current_database())) as size;
```

## FAQ

### Can I keep data in the EU?

Yes. Create the instance in Belgium, London or Frankfurt; the database, files and backups stay in that region. Auth emails are delivered by Resend, which is a separate service.

### Can I move my instance to another region later?

No. An instance's region is fixed when it's created. See [Changing an instance's region](/kb/change-region) for your options.

### Does SupaHost have SOC 2, ISO 27001 or HIPAA?

No, none of these. See [Data protection and privacy](/docs/security/data-protection) for what is in place.

## Related

- [Regions](/docs/platform/regions)
- [Backups](/docs/platform/backups)
- [Security at SupaHost](/docs/security/overview)
- [Data protection and privacy](/docs/security/data-protection)