Legal

Data Residency Statement

Last updated: June 2026

This statement describes where data processed by PrimusReview is stored and processed, including data handled by our sub-processors.

Primary data storage

DatabaseSupabase — AWS eu-west-2 (London, United Kingdom). All account data, review data, annotations, and source documents are stored in the UK.
File storageSupabase Storage — AWS eu-west-2 (London, United Kingdom). Uploaded documents and review files are stored in the UK.
AuthenticationSupabase Auth — AWS eu-west-2 (London, United Kingdom).

Application hosting

Web applicationVercel Edge Network — application code served globally via CDN. No personal data is stored at edge nodes. Request processing occurs in the nearest available region.
Serverless functionsVercel serverless functions — executed in EU region by default for UK/EU users.

AI processing

AI modelAnthropic API — United States. Document content submitted for review is transmitted to Anthropic's US-based API for processing. This constitutes an international data transfer.
TranscriptionAssemblyAI — United States. Used exclusively for the Video Review feature. Uploaded audio/video content is transmitted to AssemblyAI's US-based infrastructure for transcription. This constitutes an international data transfer.
Transfer mechanismStandard Contractual Clauses (SCCs). Anthropic and AssemblyAI process data in accordance with their respective Privacy Policies and API Data Processing terms.
Retention by AnthropicAnthropic retains API inputs for a limited period for trust and safety purposes only. API inputs are not used to train models by default.

Payment processing

StripeUnited States and European Union. Stripe processes payment card data in accordance with PCI DSS Level 1 standards. PrimusReview does not store card data.

Email

ResendUnited States. Transactional emails (welcome, account confirmation, password reset) are sent via Resend's US-based infrastructure.
Google WorkspaceUnited States and EU. Business email for PrimusReview is hosted on Google Workspace.

Important note on AI processing

International transferWhen you submit a document for review, its content is sent to Anthropic's API in the United States. This is an international data transfer outside the UK.
SafeguardsThis transfer is covered by Standard Contractual Clauses. Anthropic is a signatory to the EU-US Data Privacy Framework.
MitigationUsers should not submit documents containing identifiable patient data or confidential third-party information that they do not have the right to transfer internationally.

For questions about data residency or to discuss specific requirements, contact us at thompson.daniel@primusreview.com.