Where does my data live?

Data residency is usually sold as a menu of cloud regions, plus a contract promising the vendor will keep your data where it said it would. CueCrux starts from a stronger position: by default there is no vendor copy at all. The Crux Daemon is one free binary that runs on your own machine, CPU-only, with no account, and your agents' memory, receipts and indexes live on your disk. Residency is your jurisdiction by construction, because the data never travels.

The boundaries where data can leave the machine are few and explicit. Pro adds hosted sync and multi-device passports, which by definition places synchronised state on hosted infrastructure. The richer retrieval lanes (entity, event and navigational) run on hosted CoreCrux. Metered heavy lifts such as dense rerank, extraction and attestations are hosted services, and every credit spent on them mints a signed receipt, so even the paid boundary is visible in your trail. Decline all of these and nothing leaves. The local dense lane, using an embedder you run yourself, is never metered and never remote.

Compliance obligations that concern data location and lifecycle are handled with engineering controls. GDPR Article 17 erasure is implemented as scoped forget with a dry-run, so you can preview exactly what will be removed and hold a receipt proving that it was.

Verification is deliberately location-independent. Because receipts verify offline with corecruxctl verify-store, demonstrating the integrity of your records to an auditor does not require sending data anywhere, which is precisely the property residency-sensitive organisations need.