"Where does my prompt physically go?" is a question more customers ask every quarter, and "it depends" is not an answer a compliance team can file. So we made a simple choice early: the gateway's control plane and ledger live in Canada, in Montréal, and that's a feature we're happy to explain.
The regulatory argument
Canada's privacy regime is strict by North American standards and holds EU adequacy status, which means data flowing between European customers and our gateway rests on stable legal ground rather than framework-of-the-year agreements. For Canadian organizations — especially in Québec, where privacy law has real teeth — domestic hosting turns a paragraph of legal review into a checkbox.
The physics argument
Montréal sits on the fibre routes between Europe and the US interior: ~7 ms to Toronto, ~40 ms to Frankfurt-bound trunks, short hops to Ashburn where half the model providers live. Since the gateway adds a network hop by design, we owed it to you to place that hop somewhere geographically honest. Hydro-Québec's grid being both cheap and overwhelmingly renewable is the bonus that made the finance and the values spreadsheets agree for once.
What stays here and what doesn't
Precision matters: routing metadata and the ledger live in Canada. Your prompts transit to whichever provider you select — that's what a gateway is — and models served through the device agent never leave your own network at all. The privacy page spells out each path; the point of this post is that there's a deliberate answer at all.