Skip to content

security: drop the EU West-1 control plane and say only EU Central is in the EU - #1944

Draft
unionai-docsy-agent[bot] wants to merge 1 commit into
mainfrom
docsy/case-1739
Draft

unionai-docsy-agent[bot] wants to merge 1 commit into
mainfrom
docsy/case-1739

Conversation

@unionai-docsy-agent

Copy link
Copy Markdown
Contributor

What changed in the product

Union no longer offers eu-west-1 (Ireland) as a control plane region when an organization signs up. The signup regions are us-east-2, us-west-2, eu-west-2 (London) and eu-central-1 (Frankfurt). The GDPR page still listed EU West-1 in three places, and so did the data residency section of the data classification page. Both pages also counted EU West-2 as an EU region. London is in the United Kingdom, which is outside the EU.

Signals 1739, 1740 and 1741 (a page audit of security/compliance/gdpr.md) asked for this fix.

Changes

content/security/compliance/gdpr.md:

  • Intro paragraph (signal 1739): It now defines an EU region as a cloud region in an EU member state, and says that EU West-2 (London) is not one. The data-plane wording ("EU-region data planes" here, and "EU region" further down the page and in the verification section) therefore no longer covers a London data plane. The BYOC AWS setup page offers eu-west-2 as a data plane region. The paragraph says that an organization's control plane can be placed in EU West-2 (London) or EU Central (Frankfurt) at signup, and that full EU data residency requires EU Central. This replaces the EU West-1/West-2/Central list and the claim "ensuring organizations can deploy with full EU data residency", which was false for a London control plane. The sentence is scoped to signup because of the open question below.
  • Metadata paragraph (signal 1740): "When both planes are in EU regions (EU West-1, EU West-2, or EU Central)" now reads "When the data plane is in an EU region and the control plane is in EU Central".
  • Verification step 2 (signal 1741): Reviewers now confirm that the organization's control plane endpoint is in EU Central (eu-central-1). The old list was "EU West-1, EU West-2, EU Central".

content/security/data-protection/classification-and-residency.md (verification step 1 of the GDPR page links here):

  • EU West-1 (Ireland) is removed from the list of control plane regions.
  • "For EU-deployed data planes using an EU control plane region" now reads "For data planes in an EU member state (not eu-west-2, London) using the EU Central (eu-central-1) control plane". This page doesn't use the GDPR page's definition of an EU region, so it states the condition itself. That way it excludes London for both the control plane and the data plane.

Evidence (unionai/cloud at a1dbfa9c)

  • idl/signup/payload.proto: enum Region has reserved 3; with the comment "3 was REGION_EU_WEST_1". The remaining values are REGION_US_EAST_2, REGION_US_WEST_2, REGION_EU_WEST_2 and REGION_EU_CENTRAL_1. The removal landed in #17568 (2026-08-17).
  • clients-signup/src/app/api/create-organization/route.ts: the only EU regions it maps are eu-central-1 and eu-west-2.
  • Per-service values-production-<region>.yaml files exist only for us-east-2, us-west-2, eu-west-2 and eu-central-1.
  • alerts/status-page/betterstack.yaml: the only EU production endpoints it monitors are eu-central-1 and eu-west-2.
  • In the docs, the control plane load balancer table in security/architecture/network.md has rows for eu-west-2 and eu-central-1 and none for eu-west-1. deployment/byoc/data-plane-setup-on-aws.md has an eu-west-2 Launch Stack row, so a London data plane is possible.
  • The UK being outside the EU is general fact. The page already labelled EU West-2 as London.

Not settled: the repository still has eu-west-1 production config. deploy/tenant/prod/values-eu-west-1-overrides.yaml was last changed in #14922 (2026-03, "migrate prod eu-west-1 to lite"). hooks/deploy/hooks.yaml and envoy-gateway/deploy/alert_rules.yaml also mention eu-west-1. The source doesn't show whether organizations are still served from eu-west-1. That's why the GDPR page states the European regions as signup placement and doesn't claim that no eu-west-1 control plane exists.

Not changed

  • content/deployment/byoc/data-plane-setup-on-aws.md has an eu-west-1 Launch Stack row. That row is for the data plane, which this evidence doesn't cover, so it stays.

Open questions

  • @EngHabu, can you confirm whether any organizations were ever placed on an eu-west-1 control plane, and if so, whether they have all been moved? If some remain, both pages need to mention eu-west-1 for those organizations. Can you also confirm the wording for London: an EU West-2 control plane or data plane keeps its data in the UK, not the EU. Does Union want to say anything about UK adequacy for GDPR purposes?
  • @kumare3, can you sign off on this narrower compliance claim: only an EU Central control plane, with a data plane in an EU member state, gives full EU data residency?

Pre-flight review

Docsy's reviewer read this draft before it was opened and found 4 problems to fix. The draft was amended twice for them, and a check of the amendment found nothing left to fix.

Its optional suggestions, which the page doesn't need to be right; take them or not:

  • content/security/compliance/gdpr.md line 27: Step 2 asks the reviewer to confirm the endpoint's region but doesn't say how. security/architecture/network.md lists the control plane load balancer hostnames and IPs for each region, including eu-central-1. Point to that table so the reviewer can match their organization's endpoint against it.

Docsy case 1739: https://docsy.apps.demo.hosted.unionai.cloud/cases/1739

Drafted by Docsy, Union.ai's documentation agent, from a false statement its page audit found. Review it like any PR; close it if it's not wanted.

… in the EU

Drafted by Docsy for case 1739.

Signed-off-by: unionai-docsy-agent[bot] <336110417+unionai-docsy-agent[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown

GHA build & deploy preview

Built by .github/workflows/build-pr.yml and deployed to the docs CF Pages project by .github/workflows/deploy-pr-preview.yml.

Branch alias https://pr-1944-docsy-case-1739.docs-dog.pages.dev
This commit https://5b6e4c1b.docs-dog.pages.dev
Commit SHA 3344bab27085407f4055e6d96b3ebb125330e811

Updated automatically on every push.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants