Data Residency and Processing Reference

Last Updated: September 22, 2026.

Objective

This reference document provides information about where F5® Distributed Cloud Services process and store customer data, including persistent storage locations, non-persistent processing locations, and the sub-processors used by each supported service.

This document helps you understand the geographic locations where customer data may reside or be processed, helping you evaluate data residency, data localization, and compliance requirements for your deployments.

Note: The details provided in this document cover where data is stored and processed, and who processes that data. However, the coverage does not include what type of data is processed. See F5 Privacy Statements for a description of the data that is processed for each service.

• Non-Persistent Storage Location is a location where data is stored in memory for the purpose of immediate or imminent processing, and is cleared or overwritten from the memory after the processing is complete. For example, an F5 Distributed Cloud WAF, running at a Regional or Customer Edge, may process an HTTP request in main memory. After processing the request, the WAF may clear the memory or overwrite the memory with a new request.

• Persistent Storage Location means a location where data is stored for processing that is necessary to provide the service(s) that a customer subscribes to, but may not be immediate nor imminent. For example, an F5 Distributed Cloud service may store data for a customer at a selected location for 30 days. During that time, the customer may execute queries or generate reports based on that data. F5 SOC team may also query that data to identify malicious traffic or attack campaigns against that customer.

Acronyms for F5 Distributed Cloud Services

The following is a list of frequently used acronyms in this document:

• TAM: Technical Account Manager (Account management, Solution Engineering, and Consulting functions)
• SOC: Security Operations Center

Processing, Storage

Refer to the following table for locations of main data storage and processing, as well as the sub-processors utilized for each service.

Bot Defense

Includes Bot Defense Standard, SSD, and Aggregator management services.

Category	Locations	Notes
Persistent storage locations	United States Canada European Union Sydney São Paulo	N/A
Non-persistent processing locations	See SOC Locations and TAM Locations	N/A
Bot Defense Standard	EMEA: locations include Frankfurt, Ireland, Bahrain, Stockholm APAC: Singapore, Sydney, Mumbai, Tokyo, Hong Kong, Jakarta United States: North Virginia, Oregon LATAM: São Paulo	In case of Bot Defense Standard, there are four scrubbing center regions. The data is not persistently stored in these locations, and the customer's choice of scrubbing center is independent of the persistent storage location.

F5 Workforce AI Security (SurePath.ai)

Category	Location	Notes
Persistent Storage Locations	United States	N/A
Non-persistent processing locations	United States	N/A

Data Intelligence

Category	Locations	Notes
Persistent storage locations	United States European Union Canada Indonesia Australia	N/A
Non-persistent processing locations	United States Canada Israel Singapore See SOC Locations and TAM Locations	N/A

All data transmitted to customers transits the United States.

Client-Side Defense

Category	Locations	Notes
Persistent storage locations	United States	N/A
Non-persistent processing locations	United States Israel See SOC Locations and TAM Locations	N/A

Application Traffic Insight

Category	Locations	Notes
Persistent storage locations	United States European Union Canada Indonesia Japan Australia	N/A
Non-persistent processing locations	United States Israel See SOC Locations and TAM Locations	N/A

F5 Distributed Cloud L7 DDoS, WAF, API Protection, CDN and App Connect

Important: To ensure continuous log streaming, you must add all IP address ranges for each region to your firewall allowlist rules.

CDN logs are also exported to the EU region in addition to the local regions listed under Locations.
Flow Anomaly logs are only supported in the European Union (EU) region and not in any other region or location (EU1, US, CA, or IN).

Category	Locations	Notes
Persistent storage locations	India (IN) European Union (EU, EU1) United States (US) Canada (CA)	F5 Distributed Cloud Services supports data storage in multiple regions to help customers meet data localization requirements. For additional information, contact your F5 account team. All data transfers from persistent storage locations are encrypted over TLS. All data storage in persistent storage locations is encrypted using industry standard block encryption.
Non-persistent processing locations	Atlanta Dallas Washington, DC New York San Jose São Paulo Toronto Seattle Chennai Hong Kong Melbourne Sydney Osaka Tokyo Singapore Amsterdam Frankfurt Lisbon London Madrid Paris Stockholm Montreal Dubai Mumbai Chicago	N/A

Tip: You can find your persistent storage location in the Distributed Cloud Console. Navigate to the Administration workspace. Select Tenant Settings > Tenant Overview. In the Tenant Information section, locate Persistent storage region.

F5 Distributed Cloud L3/L4 DDoS

Category	Location	Notes
Persistent storage locations	United States	N/A

F5 AI Guardrails, F5 AI Red Team

Category	Locations	Notes
Persistent storage locations	United States	N/A
Non-persistent storage locations	United States	N/A

TAM Locations

• Argentina
• Australia
• Austria
• Bangladesh
• Belgium
• Brazil
• Canada
• Chile
• Columbia
• Croatia
• Czechia
• Denmark
• Egypt
• Finland
• France
• Germany
• Hong Kong
• India
• Indonesia
• Ireland
• Israel
• Italy
• Japan
• Korea, Republic of
• Malaysia
• Mexico
• Morocco
• Netherlands
• Norway
• Peru
• Philippines
• Poland
• Qatar
• Saudi Arabia
• Singapore
• South Africa
• Spain
• Sweden
• Switzerland
• Taiwan
• Thailand
• Turkey
• United Arab Emirates
• United Kingdom
• United States of America
• Vietnam

SOC Locations

• United States
• Poland
• Mexico
• India
• Singapore

NGINX One Console

Category	Locations	Notes
Persistent storage locations	United States	N/A
Non-persistent processing locations	United States	N/A

NGINXaaS

Category	Locations	Notes
Persistent storage locations	Australia Belgium Brazil Canada Finland Germany India Ireland Japan Netherlands Poland Singapore South Korea Sweden United Kingdom United States	F5 NGINXaaS supports data storage in multiple regions to help customers meet data sovereignty requirements. See the NGINXaaS for Azure and NGINXaaS for Google Cloud documentation for more information, including supported regions.
Non-persistent processing locations	Australia Belgium Brazil Canada Finland Germany India Ireland Japan Netherlands Poland Singapore South Korea Sweden United Kingdom United States	N/A

Sub-Processors

F5 Distributed Cloud (DDoS Protection, CDN, WAAP, AI Assistant)

Entity Name	Purpose	Entity Country
Amazon Web Services, Inc.	Cloud services hosting	United States
Google LLC	Communicates monitoring alerts to customers and a messaging application	United States
C-Serv Global Ltd	Professional services	United Kingdom
Stripe, Inc.	Payment processing	United States
Databricks, Inc.	Job orchestration for cloud services	United States
Microsoft Corporation	O365 productivity software	United States
GitLab, Inc.	Development operations platform for customer support	United States
ZenDesk, Inc.	Customer support ticket tracking. Decommissioned in December 2024.	United States
Salesforce Service Cloud (SFSC)	Customer support ticket tracking	United States
Kentik Technologies, Inc.	DDoS monitoring and logging	United States
Microsoft Azure	Cloud services hosting	United States
MongoDB, Inc.	Database and data services	United States
Tines Security Services Limited	Customer support ticket automation	Ireland

Bot Defense, Data Intelligence, Application Traffic Insight, Client-Side Defense

Entity Name	Purpose	Entity Country
Amazon Web Services, Inc.	Cloud services hosting.	United States
Okta	Identity as a service and access authentication.	United States
Google Cloud	Hosting and storage.	United States
Microsoft Corporation	O365 productivity software.	United States
ZenDesk, Inc.	Customer support ticket tracking. Decommissioned in December 2024.	United States
Salesforce Service Cloud (SFSC)	Customer support ticket tracking.	United States
Accenture, Inc.	Provide personnel to assist with support services.	United States, India
CommVault Systems Inc.	System backups	United States
Tines Security Services Limited	Customer support ticket automation	Ireland

F5 Workforce AI Security (SurePath.ai)

Entity Name	Purpose	Entity Country
Amazon Web Services, Inc.	Cloud infrastructure hosting and processing	United States
Cloudflare, Inc.	Hosting and content delivery	United States
Crowdstrike Holdings, Inc.	Information security monitoring and services	United States
Datadog, Inc.	Platform monitoring and observability	United States
Google LLC	Cloud infrastructure hosting and processing	United States
Intercom, Inc. (dba Fin)	Customer ticketing and communication	United States
MongoDB, Inc.	Database data services	United States
Salesforce, Inc. (dba Slack)	Communication monitoring and reporting	United States
WorkOS, Inc.	Identity synchronization	United States

NGINXaaS

Entity Name	Purpose	Entity Country
Salesforce Service Cloud (SFSC)	Customer support ticket tracking.	United States
Amazon Web Services, Inc.	Cloud services hosting.	United States
Google LLC	Cloud services hosting.	United States
Microsoft Corporation	Cloud services hosting.	United States
ClickHouse, Inc.	Database services.	United States
Okta, Inc.	Identity management.	United States

NGINX One Console

Entity Name	Purpose	Entity Country
Salesforce Service Cloud (SFSC)	Customer support ticket tracking.	United States
Amazon Web Services, Inc.	Cloud services hosting.	United States
ClickHouse, Inc.	Database services.	United States

F5 AI Guardrails, F5 AI Red Team

Entity Name.	Purpose	Entity Country
Amazon Web Services, Inc	Hosting Service	United States

F5 Affiliates

The sub-processors for the SaaS Offerings also include F5 Affiliates.

Country	Entity Name
Argentina	F5 Networks De Argentina SRL
Australia	F5 Networks Australia Pty. Limited
Austria	F5 Austria GmbH
Bangladesh	F5 Networks Bangladesh Ltd.
Belgium	F5 Networks Belgium BVBA
Brazil	FCinco Representacoes Do Brasil LTDA
Canada	F5 Networks Canada Ltd.
Chile	F5 Networks Chile Limitada
Colombia	F5 Networks Colombia S.A.S
Croatia	F5 Networks Zagreb LLC
Czechia	F5 Czech Republic s.r.o.
Denmark	F5 Networks Denmark ApS.
Egypt	F5 Support Services (Egypt)
Finland	F5 Networks Finland Oy
France	F5 Networks SARL
Germany	F5 Networks GmbH
Hong Kong	F5 Networks Hong Kong Limited
India	F5 Networks India Private Limited
India	F5 Networks Innovation Non-SEZ Private Limited
India	F5 Networks Innovation SEZ Private Limited
Ireland	Calypso Ireland
Ireland	NGINX International, Let.
Israel	F5 Networks, (Israel) Ltd.
Italy	F5 Networks SRL
Japan	F5 Networks Japan GK
South Korea	F5 Networks Korea Ltd.
Malaysia	F5 Networks Malaysia Sdn. Bhd.
Mexico	F5 Networks Mexico S de RL de CV
Morocco	F5 Networks Morocco
Netherlands	F5 Networks Benelux B.V.
New Zealand	F5 Networks New Zealand Limited
Peru	F5 Lima S.A.C
Philippines	F5 Networks Philippines, Inc.
Poland	F5 Networks Poland sp. z o.o.
Singapore	F5 Networks Singapore Pte Ltd
South Africa	F5 Networks South Africa
Spain	F5 Networks Iberia SL
Sweden	F5 Networks Sweden Aktiebolag
Taiwan	F5 Networks Taiwan Company Limited
Turkey	F5 Networks Turkey Teknoloji Limited Sirketi
United Kingdom	F5 Networks Ltd
United States of America	F5, Inc.
United States of America	F5 Government Solutions LLC

Note: You can subscribe to RSS Feeds to receive alerts whenever information on processing and sub-processing is updated.

Data Retention Policy

Bot Defense

F5 retains Bot Defense customer data for up to one year after termination of the customer’s contract, or upon receiving a deletion request from the customer.

Data Intelligence

F5 retains Data Intelligence customer data for up to one year after termination of the customer’s contract, or upon receiving a deletion request from the customer.

NGINXaaS

F5 retains NGINXaaS customer data, including user identity information used to authenticate and authorize users, for up to one year after termination of the customer’s contract, or upon receiving a deletion request from the customer.

---