Data Residency and Processing Reference
Last Updated: April 22, 2025
Objective
This reference document provides information on the data processing and sub-processing locations for F5 Distributed Cloud Services user data.
Note: The details provided in this document cover where data is stored and processed, and who processes that data. However, the coverage does not include what type of data is processed. See Service Specific Terms and F5 Privacy Statements for a description of the data that is processed for each service.
-
Non-Persistent Storage Location is a location where data is stored in memory for the purpose of immediate or imminent processing, and is cleared or overwritten from the memory after the processing is complete. For example, an F5 Distributed Cloud WAF, running at a Regional or Customer Edge, may process an HTTP request in main memory. After processing the request, WAF may clear the memory or overwrite the memory with a new request.
-
Persistent Storage Location means a location where data is stored for processing that is necessary to provide the service(s) that a customer subscribes to, but may not be immediate nor imminent. For example, an F5 Distributed Cloud service may store data for a customer at a selected location for 30 days. During that time, the customer may execute queries or generate reports based on that data. F5 SOC team may also query that data to identify malicious traffic or attack campaigns against that customer.
Acronyms for F5 Distributed Cloud Services
The following is a list of frequently used acronyms in this document:
- SSD: Shape Silverline Defense
- TAM: Technical Account Manager
- SOC: Security Operations Center
Processing, Storage
Refer to the following table for locations of main data storage and processing, as well as the sub-processors utilized for each service.
Bot Defense
Includes Bot Defense Basic, SSD, and Aggregator management services.
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States Canada European Union | |
| Non-persistent processing locations | See SOC Locations and TAM Locations | |
| Bot Defense Basic | EMEA: locations include Frankfurt, Ireland, Bahrain, Stockholm APAC: Singapore, Sydney, Mumbai, Tokyo, Hong Kong, Jakarta United States: North Virginia, Oregon LATAM: North Virginia/Oregon, São Paulo | In case of Bot Defense Basic, there are four scrubbing center regions. The data is not persistently stored in these locations, and the customer's choice of scrubbing center is independent of the persistent storage location. |
Authentication Intelligence
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | |
| Non-persistent processing locations | United States and TAM Locations |
Account Protection
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Australia | |
| Non-persistent processing locations | United States Canada Israel Singapore See SOC Locations and TAM Locations |
Data Intelligence
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Australia | |
| Non-persistent processing locations | United States Canada Israel Singapore See SOC Locations and TAM Locations |
All data transmitted to customers transits the United States.
Client-Side Defense
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | |
| Non-persistent processing locations | United States Israel See SOC Locations and TAM Locations |
Application Traffic Insight
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Japan Australia | |
| Non-persistent processing locations | United States Israel See SOC Locations and TAM Locations |
Silverline WAF and DDoS
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | |
| Non-persistent processing locations | United States, Canada, Mexico, Brazil, United Kingdom, Germany, Poland, Bahrain, India, Singapore, Hong Kong, Japan, Australia |
F5XC DDoS, WAF, API Protection, and CDN
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | European Union | |
| Non-persistent processing locations | Atlanta Dallas Washington,DC New York San Jose São Paulo Toronto Seattle Chennai Hong Kong Melbourne Sydney Osaka Tokyo Singapore Amsterdam Frankfurt Lisbon London Madrid Paris Stockholm Montreal Dubai Mumbai Chicago |
TAM Locations
- United States
- United Kingdom
- United Arab Emirates
- Poland
- Singapore
- Australia
- Japan
- India
- Canada
SOC Locations
- United States
- Poland
- Mexico
- India
- Singapore
Sub-Processors
F5 Distributed Cloud (DDoS Protection, CDN, WAAP, AI Assistant)
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Amazon Web Services, Inc. | Cloud services hosting | United States |
| Google LLC | Communicates monitoring alerts to customers and a messaging application | United States |
| C-Serv Global Ltd | Professional services | United Kingdom |
| Stripe, Inc. | Payment processing | United States |
| Databricks, Inc. | Job orchestration for cloud services | United States |
| Microsoft Corporation | O365 productivity software | United States |
| GitLab, Inc. | Development operations platform for customer support | United States |
| Zapier, Inc. | Workflow automation for customer support | United States |
| ZenDesk, Inc. | Customer support ticket tracking. Decommissioned in December 2024. | United States |
| Salesforce Service Cloud (SFSC) | Customer support ticket tracking | United States |
| Kentik Technologies, Inc. | DDoS monitoring and logging | United States |
| Microsoft Azure | Cloud services hosting | United States |
| Tines Security Services Limited | Customer support ticket automation | Ireland |
Bot Defense, Account Protection, Data Intelligence, Application Traffic Insight, Client-Side Defense
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Amazon Web Services, Inc. | Cloud services hosting. | United States |
| Okta | Identity as a service and access authentication. | United States |
| Google Cloud | Hosting and storage. | United States |
| Microsoft Corporation | O365 productivity software. | United States |
| ZenDesk, Inc. | Customer support ticket tracking. Decommissioned in December 2024. | United States |
| Salesforce Service Cloud (SFSC) | Customer support ticket tracking. | United States |
| Accenture, Inc. | Provide personnel to assist with support services. | United States, India |
| CommVault Systems Inc. | System backups | United States |
| Tines Security Services Limited | Customer support ticket automation | Ireland |
Silverline
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Amazon Web Services, Inc. | Cloud services hosting. | United States |
| Google LLC | Communicates monitoring alerts to customers and a messaging application. | United States |
| C-Serv Global Ltd | Professional services. | United Kingdom |
| Microsoft Corporation | O365 productivity software. | United States |
| ZenDesk, Inc. | Customer support ticket tracking. | United States |
| Kentik Technologies, Inc. | DDoS monitoring and logging. | United States |
| Tines Security Services Limited | Customer support ticket automation | Ireland |
NGINXaaS
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Microsoft Corporation | Azure Hosting | United States |
| Amazon Web Services, Inc. | Cloud services hosting. | United States |
F5 Affiliates
The sub-processors for the SaaS Offerings also include F5 Affiliates.
| Entity Name | Country |
|---|---|
| F5 Networks De Argentina S.R.L. | Argentina |
| F5 Networks Australia Pty. Limited | Australia |
| F5 Networks Belgium BVBA | Belgium |
| FCinco Representacoes do Brasil LTDA | Brazil |
| F5 Networks Canada LTD. | Canada |
| F5 Networks Chile Limitada | Chile |
| F5 Networks China | China |
| F5 Networks Colombia S.A.S. | Colombia |
| F5 Networks Zagreb LLC | Croatia |
| F5 Networks Finland Oy | Finland |
| F5 Networks SARL | France |
| F5 Networks GmbH | Germany |
| F5 Networks Hong Kong Limited | Hong Kong |
| F5 Networks India Private Limited | India |
| F5 Networks Innovation Private Limited | India |
| F5 Networks, (Israel) Ltd. | Israel |
| F5 Networks SRL | Italy |
| F5 Networks Japan GK | Japan |
| F5 Networks Korea Co., Ltd. | South Korea |
| F5 Networks Malaysia Sdn. Bhd. | Malaysia |
| F5 Networks Mexico S de RL de CV | Mexico |
| F5 Networks Benelux B.V. | Netherlands |
| F5 Networks New Zealand Limited | New Zealand |
| F5 Networks Poland sp. z o.o. | Poland |
| F5 Networks Singapore Pte Ltd | Singapore |
| F5 Networks South Africa | South Africa |
| F5 Networks Iberia SL | Spain |
| F5 Networks Sweden Aktiebolag | Sweden |
| F5 Networks Taiwan Company Limited | Taiwan |
| F5 Networks Turkey Teknoloji Limited Sirketi | Turkey |
| F5 Networks Ltd | United Kingdom |
| F5, Inc. | United States |
| NGINX International Ltd | Ireland |
| NGINX Asia Pacific Pte. | Singapore |
| Shape Security, Inc. | United States |
| Volterra, Inc. | United States |
| Volterra India Private Limited | India |
| Volterra SG PTE. LTD | Singapore |
| Acorus Networks SAS | France |
Note: You can subscribe to RSS Feeds to receive alerts whenever information on processing and sub-processing is updated.
On this page:
- Objective
- Acronyms for F5 Distributed Cloud Services
- Processing, Storage
- Bot Defense
- Authentication Intelligence
- Account Protection
- Data Intelligence
- Client-Side Defense
- Application Traffic Insight
- Silverline WAF and DDoS
- F5XC DDoS, WAF, API Protection, and CDN
- TAM Locations
- SOC Locations
- Sub-Processors
- F5 Distributed Cloud (DDoS Protection, CDN, WAAP, AI Assistant)
- Bot Defense, Account Protection, Data Intelligence, Application Traffic Insight, Client-Side Defense
- Silverline
- NGINXaaS
- F5 Affiliates