Privacy

What TollRelay holds, where, and for how long.

An organisation's record, identities, mandates and spend live in the region chosen at creation and never leave it. A person's sign-in identity lives in the identity database of their home region. The control plane holds no personal data. The sub-processor list and the retention table are published at /trust. The full privacy notice is published with the first production deploy.