Data Residency and Processing Reference
On This Page:
- Objective
- Acronyms for F5 Distributed Cloud Services
- Processing and Storage
- Bot Defense
- Authentication Intelligence
- Account Protection
- Data Intelligence
- Client-Side Defense
- Application Traffic Insight
- Silverline WAF and DDOS
- F5XC DDoS, WAF, API Protection, and CDN
- TAM Locations
- SOC Locations
- Subprocessors
- F5 Affiliates
Last Updated: January 16, 2024
Objective
This reference presents information on the data processing and sub-processing locations for F5 Distributed Cloud Services user data.
Note: The details provided in this document cover where data is stored and processed, and who processes that data. However, the coverage does not include what type of data is processed. See Service Specific Terms and F5 Privacy Statements for a description of the data that is processed for each service.
-
Non-Persistent Storage Location is a location where data is stored in memory for the purpose of immediate or imminent processing, and is cleared or overwritten from the memory after the processing is complete. For example, an F5 Distributed Cloud WAF, running at a Regional or Customer Edge, may process an HTTP request in main memory. After processing the request, WAF may clear the memory or overwrite the memory with a new request.
-
Persistent Storage Location means a location where data is stored for processing that is necessary to provide the service(s) that a customer subscribes to, but may not be immediate nor imminent. For example, an F5 Distributed Cloud service may store data for a customer at a selected location for 30 days. During that time, the customer may execute queries or generate reports based on that data. F5 SOC team may also query that data to identify malicious traffic or attack campaigns against that customer.
Acronyms for F5 Distributed Cloud Services
The following is a list of frequently used acronyms in this document and their expansions:
- SSD: Shape Silverline Defense
- TAM: Technical Account Manager
- SOC: Security Operations Center
Processing and Storage
Refer to the following table for locations of main data storage and processing.
Bot Defense
Includes Bot Defense Basic, SSD, and Aggregator management services.
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States Canada European Union | |
| Non-persistent processing locations | See SOC Locations and TAM Locations | |
| Bot Defense Basic | EMEA: locations include Frankfurt, Ireland, Bahrain, Stockholm APAC: Singapore, Sydney, Mumbai, Tokyo, Hong Kong, Jakarta United States: North Virginia, Oregon LATAM: North Virginia/Oregon, São Paulo | In case of Bot Defense Basic, there are four scrubbing center regions. The data is not persistently stored in these locations, and the customer's choice of scrubbing center is independent of the persistent storage location. |
Authentication Intelligence
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | |
| Non-persistent processing locations | United States and TAM Locations |
Account Protection
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Australia | |
| Non-persistent processing locations | United States Canada Israel Singapore See SOC Locations and TAM Locations |
Data Intelligence
This is same as Account Protection.
Client-Side Defense
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | |
| Non-persistent processing locations | United States Israel See SOC Locations and TAM Locations |
Application Traffic Insight
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Japan Australia | |
| Non-persistent processing locations | United States Israel See SOC Locations and TAM Locations |
Silverline WAF and DDOS
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | |
| Non-persistent processing locations | United States, Canada, Mexico, Brazil, United Kingdom, Germany, Poland, Bahrain, India, Singapore, Hong Kong, Japan, Australia |
F5XC DDoS, WAF, API Protection, and CDN
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | European Union | |
| Non-persistent processing locations | Atlanta Dallas Washington,DC New York San Jose São Paulo Toronto Seattle Chennai Hong Kong Melbourne Sydney Osaka Tokyo Singapore Amsterdam Frankfurt Lisbon London Madrid Paris Stockholm |
TAM Locations
- United States
- United Kingdom
- United Arab Emirates
- Poland
- Singapore
- Australia
- Japan
- India
- Canada
SOC Locations
- United States
- Poland
- Mexico
- India
- Singapore
Subprocessors
| Entity Name | Purpose | Applicable Services | Entity Country |
|---|---|---|---|
| Amazon Web Services, Inc. | Repository for file sharing and storing encrypted backups and cloud services hosting platform. | Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self-Service), Distributed Cloud Mesh, Distributed Cloud App Stack, Volt Share | United States |
| ZenDesk, Inc. | Customer support ticket tracking. | Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Mesh, Distributed Cloud App Stack, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Application Traffic Insight, Distributed Cloud Authentication Intelligence, Distributed Cloud Account Protection | United States |
| Google LLC | Communicates monitoring alerts to customers and a messaging application. | Silverline, Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| C-Serv Global Ltd | Professional services. | Silverline, Distributed Cloud Mesh, Distributed Cloud App Stack | United Kingdom |
| Okta | Identity as a service and access authentication. | Blackfish, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service) | United States |
| Google Cloud | Hosting and storage. | Blackfish, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Application Traffic Insight, Distributed Cloud Authentication Intelligence, Distributed Cloud Account Protection | United States |
| Stripe, Inc. | Payment processing. | Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| Databricks, Inc. | Job orchestration for cloud services. | Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| Microsoft, Inc. | O365 productivity software. | Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| Microsoft, Inc. | Azure hosting | NGINX on Azure | United States |
| GitLab, Inc. | Development operations platform for customer support. | Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| Zapier, Inc. | Workflow automation for customer support. | Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| Kentik Technologies, Inc. | DDoS monitoring and logging. | Silverline DDoS Protection Service, Distributed Cloud Mesh, Distributed Cloud App Stack | United States |
| CommVault Systems Inc. | System backups | Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Distributed Cloud Authentication Intelligence, Distributed Cloud Account Protection | United States |
| Accenture, Inc. | Provide personnel to assist with support services. | Distributed Cloud Account Protection | United States, India |
| Tines Security Services Limited | Customer support ticket automation | Silverline, Beacon, DNS, DNS Load Balancer, Essential App Protect, Distributed Cloud Mesh, Distributed Cloud App Stack, Distributed Cloud Bot Defense (Managed Service), Distributed Cloud Bot Defense (Self Service), Application Traffic Insight, Distributed Cloud Authentication Intelligence, Distributed Cloud Account Protection | Ireland |
F5 Affiliates
The Subprocessors for the SaaS Offerings also include F5 Affiliates.
| Entity Name | Country |
|---|---|
| F5 Networks De Argentina S.R.L. | Argentina |
| F5 Networks Australia Pty. Limited | Australia |
| F5 Networks Belgium BVBA | Belgium |
| FCinco Representacoes do Brasil LTDA | Brazil |
| F5 Networks Canada LTD. | Canada |
| F5 Networks Chile Limitada | Chile |
| F5 Networks China | China |
| F5 Networks Colombia S.A.S. | Colombia |
| F5 Networks Zagreb LLC | Croatia |
| F5 Networks Finland Oy | Finland |
| F5 Networks SARL | France |
| F5 Networks GmbH | Germany |
| F5 Networks Hong Kong Limited | Hong Kong |
| F5 Networks India Private Limited | India |
| F5 Networks Innovation Private Limited | India |
| F5 Networks, (Israel) Ltd. | Israel |
| F5 Networks SRL | Italy |
| F5 Networks Japan GK | Japan |
| F5 Networks Korea Co., Ltd. | South Korea |
| F5 Networks Malaysia Sdn. Bhd. | Malaysia |
| F5 Networks Mexico S de RL de CV | Mexico |
| F5 Networks Benelux B.V. | Netherlands |
| F5 Networks New Zealand Limited | New Zealand |
| F5 Networks Poland sp. z o.o. | Poland |
| F5 Networks Singapore Pte Ltd | Singapore |
| F5 Networks South Africa | South Africa |
| F5 Networks Iberia SL | Spain |
| F5 Networks Sweden Aktiebolag | Sweden |
| F5 Networks Taiwan Company Limited | Taiwan |
| F5 Networks Turkey Teknoloji Limited Sirketi | Turkey |
| F5 Networks Ltd | United Kingdom |
| F5, Inc. | United States |
| NGINX International Ltd | Ireland |
| NGINX Ltd | Russia |
| NGINX Asia Pacific Pte. | Singapore |
| Shape Security, Inc. | United States |
| Volterra, Inc. | United States |
| Volterra India Private Limited | India |
| Volterra SG PTE. LTD | Singapore |
| Acorus Networks SAS | France |
Note: You can subscribe to RSS Feeds to receive alerts whenever information on processing and sub-processing is updated.