Data residency

The specifics:

• Database (Cloud Firestore): European Union (eur3 multi-region) — the system of record for account data, plugin configuration, and plugin-collected end-shopper data.
• Authentication (Firebase Authentication) and file storage (Cloud Storage): Google Cloud. Firebase Authentication and Cloud Storage run on Google Cloud; like our database, they are configured for EU data handling.
• Tóg-paid AI (Google Vertex AI): the EU region (europe-west1 by default) when the Vertex model path is used — see the AI Data Handling page.

Your primary data is stored within the EU, which supports your own GDPR obligations. Where we (or a feature you enable) send data to a sub-processor established outside the EU/EEA, that is an international transfer handled under appropriate safeguards — see International transfers below.

We host in the EU regardless of where your business is based. That means that even if your business is outside the EU, your data (and your customers’ data) resides in the European Union on our primary store. We disclose this clearly because:

• it is generally a benefit — your data sits under a strong data-protection regime, and it is well placed if you serve EU customers;
• but some businesses have their own data-localisation requirements, so you should confirm that EU storage is acceptable for your situation before you rely on the service.

If you have a specific data-location requirement, contact us at support@togs.ie before onboarding.

Some of our sub-processors are established in the United States — our hosting and AI gateway provider (Vercel), our payment processor (Stripe), the AI model providers (OpenAI, Anthropic) when AI-chat is used, our email provider (Resend), and Twilio where a tenant enables SMS. When data is sent to one of these, it leaves the EU/EEA — an international transfer.

These transfers are governed by the appropriate GDPR safeguards — we rely on the European Commission’s Standard Contractual Clauses (and any applicable UK Addendum or Swiss adequacy arrangement), entered into with each relevant sub-processor.

The complete, dated list of sub-processors — including each one’s region — is on the Sub-processors page, and the transfer mechanics are set out in our Data Processing Addendum.

Payment card details are entered with and held by Stripe, our payment processor — Tóg never receives or stores card numbers. Card data is therefore handled in Stripe’s environment under Stripe’s own certifications and regions, not in our database.