Skip to main content

Data Residency & Sovereignty

Witboost is designed to give customers complete control over where their data resides and is processed.

EU-Based Company​

HeadquartersAgile Lab S.r.l. — Milan, Italy
DevelopmentEntirely within the EU/EEA
SupportDelivered by EU/EEA-based personnel
Data ProcessingExclusively within the EU/EEA

Agile Lab does not operate from any location outside the EU/EEA.

Customer-Controlled Data Residency​

Because Witboost is deployed in the customer's own infrastructure, data residency is entirely under customer control:

  • On-premises — All data stays within the customer's physical data center
  • Private cloud — Customer chooses the cloud provider and region
  • Hybrid — Mix of on-premises and cloud, with customer-defined data boundaries

No data is replicated to or stored on Agile Lab infrastructure.

No Outbound Data Flows​

In a standard deployment, Witboost generates zero outbound data flows:

  • No phone-home or telemetry
  • No usage analytics
  • No diagnostic data transmission
  • No license validation calls
  • Fully air-gapped operation supported

EU Personnel Only​

When Agile Lab personnel require access to a customer environment (e.g., during professional services engagements):

  • Access is performed exclusively from EU/EEA locations
  • This restriction can be contractually committed
  • Access is initiated by the customer, time-bound, and logged

Art. 46 GDPR Safeguards​

For any sub-processor located outside the EU/EEA, Agile Lab ensures:

  • EU Standard Contractual Clauses (SCCs) per Commission Implementing Decision (EU) 2021/914
  • Supplementary technical measures (encryption, pseudonymisation, access controls) applied as appropriate
  • Traceable access controls and four-eyes principle for access handling

Contractual Commitments​

Agile Lab can contractually guarantee:

  1. No data transfers to third countries occur as part of Witboost platform operation
  2. All access by Agile Lab personnel occurs exclusively within the EU/EEA
  3. The customer retains an extraordinary termination right if sub-processors change
  4. Prior written approval (opt-in) is required for any sub-processor changes