XBOW Data Residency now Available in Australia, Canada, and Japan
Security teams in different countries asked to keep their assessment data at home, so we built three new regions.
After we launched EU data residency in March, security teams across Asia Pacific and North America asked us for the same option.
The requests came from banks, insurers, energy providers, telecoms, and government-adjacent organizations. Many of them were already evaluating XBOW. Before they could deploy it, they had one condition to meet: assessment data had to stay in their own country.
We heard it in enough conversations, across enough regulated industries, to treat it as a product requirement. Today XBOW data residency is live in Australia, Canada, and Japan, alongside the EU and Singapore.
The data behind a finding
XBOW proves each finding with a working exploit and records the proof of concept and the endpoint it reached. Assessment traces show how your web application is built, and the credentials you store for testing open live systems.
Security teams hold that data to the same standard as customer data. For regulated organizations in these three countries, that standard means keeping it in-country.
What we built
We stood up three new XBOW deployments on AWS, one in each country:
| Region | AWS Location | Console |
|---|---|---|
| Australia | Asia Pacific (Sydney) | console.au.xbow.com |
| Canada | Canada (Central) | console.ca.xbow.com |
| Japan | Asia Pacific (Tokyo) | console.jp.xbow.com |
Each one runs the full XBOW platform, with the same autonomous assessments and validated findings you get on console.xbow.com. You sign in at your regional URL and work the way you do today.
What stays in-country
Your security-sensitive data is stored in your region: findings, assessment results and reports, asset inventory, credentials and secrets, assessment guidance such as uploaded specs and source code, audit logs, and user identity.
We keep a small set of operational data global: billing and account details, support tickets, and platform telemetry. None of it describes your vulnerabilities or your security posture. Our data residency documentation has the full list.
Your existing protections still apply. Our data processing agreement and security practices cover you wherever your data lives.
Data residency covers where XBOW stores your data. During assessments, XBOW uses approved global model providers, so model processing may happen outside your region. If your policies require in-country model processing, talk to your sales team before you onboard.
Getting started
Tell your sales team which region you need. We provision your organization there, and you onboard at your regional console.
Choose with the long term in mind. Each organization lives in one region, and we can't move it to another one later. API keys and webhooks work only in the region where you create them.
Keep asking
These three regions exist because security teams asked for them. If your organization needs a region we don't cover yet, tell us. We use those requests to decide where to build next.
Data residency in Australia, Canada, and Japan is available now in Private Preview for XBOW customers. Contact your sales or customer success team to get started.
If you're not yet on XBOW, request a demo.
