# Singapore only, and we will show you exactly where the line is. **Singapore only, and we will show you exactly where the line is.** Every workspace is created in the Singapore region. Customer content, run state, evidence and audit records stay there. The region is chosen at workspace creation and cannot be changed afterwards — that is a deliberate constraint, and it is stated on the creation screen in bold. Singapore is the only region at launch. No additional regions are committed; if one is added, existing workspaces are unaffected. [Trust Centre](/trust/trust) · Data residency & sovereignty [Talk to a solutions engineer](/book-demo) [Compare deployment models](/deployment) Primary region Singapore Regions available 1 Region mutability Immutable Chosen at Workspace creation Backups In-region only Support tooling In-region only ## The plane split, without the architecture diagram KrewOS separates governance from execution. The Control Plane decides what is allowed; the Execution Plane does the work and holds the data. Keeping those apart is what lets one governance model coexist with strict residency, because the two do not have to live in the same place. **Control Plane** Holds identity, the component catalogue, Crew Manifests, policies, evaluation suites, releases and entitlements. It knows what your crews are allowed to do. It does not hold the documents they work on. Identity & RBAC Catalogue Manifests Policies Evaluations Releases Entitlements Billing metadata **Execution Plane** Runs the compiled plan and holds run state, retrieved content, generated artefacts, evidence records, human decisions and the audit trail. This is where your data actually is, and it is the plane that moves under the enterprise deployment tiers. Run state Knowledge content Retrieved evidence Generated artefacts Correction Records Audit trail Secrets references ## Five deployment tiers Governance stays central in all five. What changes is where execution runs and who operates the infrastructure underneath it. | Tier | Where execution runs | Where your content sits | Operated by | Typical buyer | CMK | | - | - | - | - | - | - | | KrewOS Cloud | Managed, shared, Singapore | KrewOS Singapore region | wGrow | SME and standard enterprise | No | | KrewOS Cloud Dedicated | Managed, dedicated resources, Singapore | KrewOS Singapore region, isolated | wGrow | Higher isolation or performance needs | Yes | | Enterprise — Customer VPC | Your cloud account | Your account, your region | Shared — we deploy, you own the account | Residency rules and private-system access | Yes | | Enterprise — Hybrid | Local runtime, central governance | Your premises for knowledge and run state | Shared | Private data with managed governance | Yes | | Enterprise — Private / Local | Your infrastructure | Entirely yours | You, with our support | Restricted or disconnected environments | Yes | ### What never leaves the region On KrewOS Cloud, the following data classes are stored and processed only in Singapore. Where something does cross a boundary, it is named here rather than omitted. | Data class | Stored in | Processed in | Leaves the region? | | - | - | - | - | | Knowledge Pack content and embeddings | Singapore | Singapore | Never | | Run state, checkpoints and artefacts | Singapore | Singapore | Never | | Evidence records and retrieval traces | Singapore | Singapore | Never | | Human decisions and Correction Records | Singapore | Singapore | Never | | Audit trail and exports | Singapore | Singapore | Never | | Backups and point-in-time archives | Singapore | Singapore | Never | | Support and diagnostic tooling | Singapore | Singapore | Never | | Model inference payloads | Not stored by the provider | Singapore-resident endpoints | Only to approved in-region endpoints | | Account and billing metadata | Singapore | Singapore | Never | | Aggregate platform telemetry (no content) | Singapore | Singapore | Never | **Model provider residency** A model profile declares the jurisdictions its endpoints may sit in and the retention terms required of the provider. The runtime refuses to route to an endpoint outside the declared set, so residency is enforced by configuration rather than by an operator remembering. **In-region endpoints only** Approved models must offer a Singapore-resident endpoint to be added to the list. **Zero retention required** Providers must contractually agree to no retention and no training on submitted content. **Bring your own key** Use your own provider contracts and your own negotiated terms; we hold the credential as an encrypted reference and never in a prompt. **Private model adapters** Point the gateway at a model you host yourself, including inside a disconnected environment. **Region immutability** A workspace's region is fixed at creation. Changing it later would be a full data migration for both parties, so we do not offer it as a setting that looks reversible when it is not. - **Chosen at**\ Workspace creation - **Changeable later**\ No - **Migration path**\ New workspace, exported manifests - **What migrates**\ Manifests, components, policies - **What does not**\ Run history, audit trail - **Multiple regions per tenant**\ Supported once a second region exists If your obligations require data to sit outside Singapore today, the answer is a Customer VPC or Private deployment, not a region setting we do not have. --- wGrow Technologies Pte Ltd · Singapore · Residency commitments described apply to KrewOS Cloud and Cloud Dedicated. Self-hosted tiers place residency under your control and are documented in the deployment guide. Canonical page: https://dev.krewos.ai/trust/residency