Data Residency and Processing Reference

Last Updated: January 16, 2024

Objective

This reference presents information on the data processing and sub-processing locations for F5 Distributed Cloud Services user data.

Note: The details provided in this document cover where data is stored and processed, and who processes that data. However, the coverage does not include what type of data is processed. See Service Specific Terms and F5 Privacy Statements for a description of the data that is processed for each service.

  • Non-Persistent Storage Location is a location where data is stored in memory for the purpose of immediate or imminent processing, and is cleared or overwritten from the memory after the processing is complete. For example, an F5 Distributed Cloud WAF, running at a Regional or Customer Edge, may process an HTTP request in main memory. After processing the request, WAF may clear the memory or overwrite the memory with a new request.

  • Persistent Storage Location means a location where data is stored for processing that is necessary to provide the service(s) that a customer subscribes to, but may not be immediate nor imminent. For example, an F5 Distributed Cloud service may store data for a customer at a selected location for 30 days. During that time, the customer may execute queries or generate reports based on that data. F5 SOC team may also query that data to identify malicious traffic or attack campaigns against that customer.

Acronyms for F5 Distributed Cloud Services

The following is a list of frequently used acronyms in this document and their expansions:

  • IBD: Integrated Bot Defense
  • SSD: Shape Silverline Defense
  • SAFE: Shape AI Fraud Engine
  • AP: Account Protection
  • TAM: Technical Account Manager
  • SOC: Security Operations Center

Processing and Storage

Refer to the following table for locations of main data storage and processing.

Bot Defense

Includes IBD, SSD, and Aggregator management services.

CategoryLocationsNotes
Persistent storage locationsUnited States
Canada
European Union
Non-persistent processing locationsSee SOC Locations and TAM Locations
IBDEMEA: locations include Frankfurt, Ireland, Bahrain, Stockholm
APAC: Singapore, Sydney, Mumbai, Tokyo, Hong Kong, Jakarta
United States: North Virginia, Oregon
LATAM: North Virginia/Oregon, São Paulo
In case of IBD, there are four scrubbing center regions. The data is not persistently stored in these locations, and the customer's choice of scrubbing center is independent of the persistent storage location.

Authentication Intelligence

CategoryLocationsNotes
Persistent storage locationsUnited States
Non-persistent processing locationsUnited States and TAM Locations

Account Protection

CategoryLocationsNotes
Persistent storage locationsUnited States
European Union
Canada
Indonesia
Australia
Non-persistent processing locationsUnited States
Canada
Israel
Singapore
See SOC Locations and TAM Locations

Data Intelligence

This is same as SAFE or AP.

Client-Side Defense

CategoryLocationsNotes
Persistent storage locationsUnited States
Non-persistent processing locationsUnited States
Israel
See SOC Locations and TAM Locations

Application Traffic Insight

CategoryLocationsNotes
Persistent storage locationsUnited States
European Union
Canada
Indonesia
Japan
Australia
Non-persistent processing locationsUnited States
Israel
See SOC Locations and TAM Locations

Silverline WAF and DDOS

CategoryLocationsNotes
Persistent storage locationsUnited States
Non-persistent processing locationsUnited States, Canada, Mexico, Brazil, United Kingdom, Germany, Poland, Bahrain, India, Singapore, Hong Kong, Japan, Australia

F5XC DDoS, WAF, API Protection, and CDN

CategoryLocationsNotes
Persistent storage locationsEuropean Union
Non-persistent processing locationsAtlanta
Dallas
Washington,DC
New York
San Jose
São Paulo
Toronto
Seattle
Chennai
Hong Kong
Melbourne
Sydney
Osaka
Tokyo
Singapore
Amsterdam
Frankfurt
Lisbon
London
Madrid
Paris
Stockholm

TAM Locations

  • United States
  • United Kingdom
  • United Arab Emirates
  • Poland
  • Singapore
  • Australia
  • Japan
  • India
  • Canada

SOC Locations

  • United States
  • Poland
  • Mexico
  • India
  • Singapore

Subprocessors

Entity NamePurposeApplicable ServicesEntity Country
Amazon Web Services, Inc.Repository for file sharing and storing encrypted backups and cloud services hosting platform.Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self-Service), Distributed Cloud Mesh, Distributed Cloud App Stack, Volt ShareUnited States
ZenDesk, Inc.Customer support ticket tracking.Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Mesh, Distributed Cloud App Stack, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Application Traffic Insight, Distributed Cloud Authentication Intelligence, Distributed Cloud Account ProtectionUnited States
Google LLCCommunicates monitoring alerts to customers and a messaging application.Silverline, Distributed Cloud Mesh, Distributed Cloud App StackUnited States
C-Serv Global LtdProfessional services.Silverline, Distributed Cloud Mesh, Distributed Cloud App StackUnited Kingdom
OktaIdentity as a service and access authentication.Blackfish, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service)United States
Google CloudHosting and storage.Blackfish, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Application Traffic Insight, Distributed Cloud Authentication Intelligence, Distributed Cloud Account ProtectionUnited States
Stripe, Inc.Payment processing.Distributed Cloud Mesh, Distributed Cloud App StackUnited States
Databricks, Inc.Job orchestration for cloud services.Distributed Cloud Mesh, Distributed Cloud App StackUnited States
Microsoft, Inc.O365 productivity software.Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Mesh, Distributed Cloud App StackUnited States
Microsoft, Inc.Azure hostingNGINX on AzureUnited States
GitLab, Inc.Development operations platform for customer support.Distributed Cloud Mesh, Distributed Cloud App StackUnited States
Zapier, Inc.Workflow automation for customer support.Distributed Cloud Mesh, Distributed Cloud App StackUnited States
Kentik Technologies, Inc.DDoS monitoring and logging.Silverline DDoS Protection Service, Distributed Cloud Mesh, Distributed Cloud App StackUnited States
CommVault Systems Inc.System backupsDistributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Distributed Cloud Authentication Intelligence, Distributed Cloud Account ProtectionUnited States
Accenture, Inc.Provide personnel to assist with support services.Distributed Cloud Account ProtectionUnited States, India
Tines Security Services LimitedCustomer support ticket automationSilverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Mesh, Distributed Cloud App Stack, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Application Traffic Insight, Distributed Cloud Authentication Intelligence, Distributed Cloud Account ProtectionIreland

F5 Affiliates

The Subprocessors for the SaaS Offerings also include F5 Affiliates.

Entity NameCountry
F5 Networks De Argentina S.R.L.Argentina
F5 Networks Australia Pty. LimitedAustralia
F5 Networks Belgium BVBABelgium
FCinco Representacoes do Brasil LTDABrazil
F5 Networks Canada LTD.Canada
F5 Networks Chile LimitadaChile
F5 Networks ChinaChina
F5 Networks Colombia S.A.S.Colombia
F5 Networks Zagreb LLCCroatia
F5 Networks Finland OyFinland
F5 Networks SARLFrance
F5 Networks GmbHGermany
F5 Networks Hong Kong LimitedHong Kong
F5 Networks India Private LimitedIndia
F5 Networks Innovation Private LimitedIndia
F5 Networks, (Israel) Ltd.Israel
F5 Networks SRLItaly
F5 Networks Japan GKJapan
F5 Networks Korea Co., Ltd.South Korea
F5 Networks Malaysia Sdn. Bhd.Malaysia
F5 Networks Mexico S de RL de CVMexico
F5 Networks Benelux B.V.Netherlands
F5 Networks New Zealand LimitedNew Zealand
F5 Networks Poland sp. z o.o.Poland
F5 Networks Singapore Pte LtdSingapore
F5 Networks South AfricaSouth Africa
F5 Networks Iberia SLSpain
F5 Networks Sweden AktiebolagSweden
F5 Networks Taiwan Company LimitedTaiwan
F5 Networks Turkey Teknoloji Limited SirketiTurkey
F5 Networks LtdUnited Kingdom
F5, Inc.United States
NGINX International LtdIreland
NGINX LtdRussia
NGINX Asia Pacific Pte.Singapore
Shape Security, Inc.United States
Volterra, Inc.United States
Volterra India Private LimitedIndia
Volterra SG PTE. LTDSingapore
Acorus Networks SASFrance

Note: You can subscribe to RSS Feeds to receive alerts whenever information on processing and sub-processing is updated.