One home for every memory: Switzerland.
Wherever you or your business are, your memory is stored in Zurich, encrypted and opened only to answer you, under Swiss privacy law and outside both EU and US jurisdiction. Storage, backups, encryption keys, processing and support access all live there. Nothing about your memory leaves Switzerland unless you connect a model that runs elsewhere — and that choice is yours, per key.
Homes
| Home | Serves | Location | Status |
|---|---|---|---|
| Switzerland | Everyone, everywhere: every free personal memory and every business memory, unless a sector rule requires in-country storage | AWS Zurich (eu-central-2) | Live |
| United States | US organisations whose data must stay in the United States by law: ITAR/EAR technical data, criminal-justice information, federal tax information, HIPAA customers who require it, Florida and Texas patient records | AWS United States (N. Virginia, us-east-1) | In build |
| Singapore | Asia-Pacific organisations whose rules require in-region storage | AWS Singapore (ap-southeast-1) | In build |
| Dedicated | One customer: a single-tenant Agentu operated by Agentu in the region the customer chooses, per deployment. Dedicated → | The region you choose | On request |
| Switzerland, Agentu-owned hardware | The same service, shared or Dedicated, on hardware Agentu owns and operates in Switzerland, with an HSM-backed key store | Switzerland | Planned |
A home is marked live only once it is serving customers. We announce each one here, in the privacy policy and in the changelog. Sign-up from this website happens on memory.agentu.com, in Switzerland.
Agentu Professional In build: each company chooses its cell, Switzerland by default, with the United States and Singapore as they go live, EU and UK cells on demand, or a Dedicated instance in the region it chooses. Divisions and projects inherit the company's cell and cannot move to a less strict one without an admin decision recorded in the audit log. Residency and compliance frame for Professional →
Why Switzerland, for everyone?
Swiss privacy law
The revised Federal Act on Data Protection is strict, supervised by an independent commissioner, and Swiss courts are independent. Switzerland is in neither the EU nor the US, so neither bloc's cloud-sovereignty debates reach your memory.
Recognised as adequate
Switzerland has had an EU adequacy decision since 2000, confirmed under the GDPR in 2024, and is on the UK adequacy list. For European and British customers, storing data in Switzerland is a permitted transfer with no extra paperwork.
Encrypted so location is the second line
Memories are stored encrypted and opened only to answer your AI; hold your own keys and they exist only on your devices, so a demand served on Agentu, or on its infrastructure provider, can yield ciphertext and nothing else. Swiss law protects the metadata and the process; the cryptography protects the content.
One home, one story
A client, a regulator or an auditor can be told where the data is in one sentence. No per-customer region mapping, no replication, no copies in a second jurisdiction.
Personal and business alike
The free personal memory and the business vault share the same Swiss home and the same cryptography. There is no lesser tier that lives somewhere else.
Regional homes when the law insists
Where a sector rule requires data to stay in-country, a regional home in the United States or Singapore holds that customer's memory with the same guarantees. Nothing is replicated between homes.
What "in Switzerland" covers
Storage and backups
The database, its encrypted backups and every replica are in Switzerland. There is no cross-border copy.
Keys
Keys managed by Agentu, the default, live in a Swiss hardware-backed key store and open a memory only to answer your AI, alongside the service keys that protect everything else; none of them leaves it. Hold your own keys and they exist only on your devices. Agentu Sealed keys (in build) are kept in the same Swiss key store, wrapped so that they turn only with your biometric. On a Dedicated instance, the key store sits in the region you chose.
Processing
Decryption for a request you authorised happens on servers in Switzerland. Logs and metrics, which never contain content, stay there too.
Support and operations
Operational access is restricted to the Swiss environment and logged. Nobody at Agentu reads memories: there is no screen, tool or support path that shows content; managed keys open a memory only inside a request that answers your AI. Memories under your own keys cannot be read by that access at all, and Sealed memories only inside the enclave during a grant you unlocked. A Dedicated instance is operated the same way, in its own region.
Models you connect
A model runs where its provider runs it. Each key you issue says which models may read which categories, so a European firm can keep a US-hosted model away from a European client's matter — or send only the sanitised slice it needs.
Deletion
Destroying a key makes the data unreadable in every copy at once. Erasure requests do not depend on finding files.
Which countries require data to stay in-country?
Most countries do not. They allow personal data to be hosted abroad provided a recognised mechanism is in place — an adequacy decision, standard contractual clauses, a certification or, in some countries, consent. Encryption does not take data outside those laws, but it does mean that what sits in Switzerland is unreadable to anyone without your keys, which is what most of those mechanisms are trying to achieve. A smaller number of countries require some or all data to be physically stored in-country, and for those Agentu offers a regional home or says "not served". The table summarises the position as we understand it on 6 October 2026; it is a product description, not legal advice, and every business customer should confirm its own obligations with counsel.
| Where your data comes from | In-country storage required? | Agentu home |
|---|---|---|
| EU / EEA | No general rule. Sector exceptions: French health-data hosting (HDS) must be in the EEA; German health and social data in the cloud needs a C5 attestation and a German establishment. | Switzerland (EU adequacy decision). French HDS-scope and German §393 SGB V data: not yet served. |
| United Kingdom | No. | Switzerland (UK adequacy). |
| Switzerland | No. | Switzerland. |
| United States | No general rule. Sector rules keep certain data in the US: ITAR/EAR technical data, criminal-justice (CJIS), federal tax information, DoD IL4/IL5, and Florida and Texas patient records. | Switzerland for general business and personal data. United States home, when live, for the sector data listed. |
| Singapore, Japan, South Korea, Australia, Malaysia, Hong Kong, Philippines, Thailand | No general rule; transfers need a contract, certification or disclosure. Exceptions: Australia's My Health Record system; Korean public-sector cloud. | Switzerland under the applicable contract or certification. Singapore home, when live, where a rule requires in-region storage. |
| India | No general rule yet (DPDP Act). Sector rules keep payment, securities, insurance and government data in India; from 2027 "significant data fiduciaries" may be told to keep specified data in India. | Switzerland for general business data. Regulated data: not yet served. |
| Indonesia, Vietnam | Partial: Indonesian public-scope operators; Vietnamese domestic telecom, internet and value-added providers. Vietnam requires a transfer-impact filing. | Switzerland for private-sector customers outside those categories. |
| China | Yes for critical-infrastructure operators, "important data" and personal data above regulatory volume thresholds; a government assessment, filed contract or certification is needed to export the rest. | Not served for in-country data. Switzerland only for data lawfully exportable with a CAC mechanism. |
| Russia, Kazakhstan | Yes: citizens' personal data must be stored in databases in the country. | Not served. |
| Saudi Arabia, UAE | By sector: Saudi government, critical infrastructure, health, finance, telecom and insurance; UAE health data. General business data may be hosted abroad under contract. | Switzerland for general business data. Regulated data: not yet served. |
| Canada | Private sector: no (Quebec needs an assessment). Public bodies: Nova Scotia and federal Protected B data stay in Canada. | Switzerland for the private sector. Public bodies: not served. |
| Brazil, Turkey, Nigeria, Kenya, South Africa | No general rule; Brazil needs its mandatory standard clauses, Turkey a filed standard contract. Sector exceptions: Turkish banks and payments; Nigerian payment data from 2027; Kenyan "strategic interest" data such as healthcare. | Switzerland, under the applicable clauses. |
Where a rule requires in-country storage that no home can satisfy, we say "not served" rather than stretching a home to fit. Additional homes follow demand; if yours is missing, tell us.
Transfers between Switzerland and anywhere else
Agentu signs a data-processing agreement with every business customer. Where a model you connect, or Agentu's own support, would involve access from another jurisdiction, the agreement carries the mechanism that jurisdiction requires: EU and UK standard contractual clauses with a transfer-impact assessment, the Swiss clauses, Brazil's mandatory clauses, Turkey's standard contract. The EU–US Data Privacy Framework exists and is under legal pressure in 2026; we do not rely on it alone. Compliance in full →