Data Residency and Processing Reference
Last Updated: April 29, 2026.
Objective
This reference document provides information on the data processing and sub-processing locations for F5 Distributed Cloud Services user data.
Note: The details provided in this document cover where data is stored and processed, and who processes that data. However, the coverage does not include what type of data is processed. See Service Specific Terms and F5 Privacy Statements for a description of the data that is processed for each service.
-
Non-Persistent Storage Location is a location where data is stored in memory for the purpose of immediate or imminent processing, and is cleared or overwritten from the memory after the processing is complete. For example, an F5 Distributed Cloud WAF, running at a Regional or Customer Edge, may process an HTTP request in main memory. After processing the request, WAF may clear the memory or overwrite the memory with a new request.
-
Persistent Storage Location means a location where data is stored for processing that is necessary to provide the service(s) that a customer subscribes to, but may not be immediate nor imminent. For example, an F5 Distributed Cloud service may store data for a customer at a selected location for 30 days. During that time, the customer may execute queries or generate reports based on that data. F5 SOC team may also query that data to identify malicious traffic or attack campaigns against that customer.
Acronyms for F5 Distributed Cloud Services
The following is a list of frequently used acronyms in this document:
- TAM: Technical Account Manager (Account management, Solution Engineering, and Consulting functions)
- SOC: Security Operations Center
Processing, Storage
Refer to the following table for locations of main data storage and processing, as well as the sub-processors utilized for each service.
Bot Defense
Includes Bot Defense Standard, SSD, and Aggregator management services.
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States Canada European Union Sydney São Paulo | N/A |
| Non-persistent processing locations | See SOC Locations and TAM Locations | N/A |
| Bot Defense Standard | EMEA: locations include Frankfurt, Ireland, Bahrain, Stockholm APAC: Singapore, Sydney, Mumbai, Tokyo, Hong Kong, Jakarta United States: North Virginia, Oregon LATAM: São Paulo | In case of Bot Defense Standard, there are four scrubbing center regions. The data is not persistently stored in these locations, and the customer's choice of scrubbing center is independent of the persistent storage location. |
Data Intelligence
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Australia | N/A |
| Non-persistent processing locations | United States Canada Israel Singapore See SOC Locations and TAM Locations | N/A |
All data transmitted to customers transits the United States.
Client-Side Defense
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | N/A |
| Non-persistent processing locations | United States Israel See SOC Locations and TAM Locations | N/A |
Application Traffic Insight
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States European Union Canada Indonesia Japan Australia | N/A |
| Non-persistent processing locations | United States Israel See SOC Locations and TAM Locations | N/A |
F5 Distributed Cloud L7 DDoS, WAF, API Protection, CDN and App Connect
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | India European Union United States Canada | F5 Distributed Cloud Services now supports data storage in multiple regions to help customers meet data localization requirements. To explore more, reach out to your F5 account team. CDN logs are also exported to the EU region in addition to the local regions listed under Locations. |
| Non-persistent processing locations | Atlanta Dallas Washington, DC New York San Jose São Paulo Toronto Seattle Chennai Hong Kong Melbourne Sydney Osaka Tokyo Singapore Amsterdam Frankfurt Lisbon London Madrid Paris Stockholm Montreal Dubai Mumbai Chicago | N/A |
F5 Distributed Cloud L3/L4 DDoS
| Category | Location | Notes |
|---|---|---|
| Persistent storage locations | United States | N/A |
F5 AI Guardrails, F5 AI Red Team
| Category | Locations | Notes |
|---|---|---|
| Persistent storage locations | United States | N/A |
| Non-persistent storage locations | United States | N/A |
TAM Locations
- Argentina
- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Canada
- Chile
- Columbia
- Croatia
- Czechia
- Denmark
- Egypt
- Finland
- France
- Germany
- Hong Kong
- India
- Indonesia
- Ireland
- Israel
- Italy
- Japan
- Korea, Republic of
- Malaysia
- Mexico
- Morocco
- Netherlands
- Norway
- Peru
- Philippines
- Poland
- Qatar
- Saudi Arabia
- Singapore
- South Africa
- Spain
- Sweden
- Switzerland
- Taiwan
- Thailand
- Turkey
- United Arab Emirates
- United Kingdom
- United States of America
- Vietnam
SOC Locations
- United States
- Poland
- Mexico
- India
- Singapore
Sub-Processors
F5 Distributed Cloud (DDoS Protection, CDN, WAAP, AI Assistant)
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Amazon Web Services, Inc. | Cloud services hosting | United States |
| Google LLC | Communicates monitoring alerts to customers and a messaging application | United States |
| C-Serv Global Ltd | Professional services | United Kingdom |
| Stripe, Inc. | Payment processing | United States |
| Databricks, Inc. | Job orchestration for cloud services | United States |
| Microsoft Corporation | O365 productivity software | United States |
| GitLab, Inc. | Development operations platform for customer support | United States |
| ZenDesk, Inc. | Customer support ticket tracking. Decommissioned in December 2024. | United States |
| Salesforce Service Cloud (SFSC) | Customer support ticket tracking | United States |
| Kentik Technologies, Inc. | DDoS monitoring and logging | United States |
| Microsoft Azure | Cloud services hosting | United States |
| MongoDB, Inc. | Database and data services | United States |
| Tines Security Services Limited | Customer support ticket automation | Ireland |
Bot Defense, Data Intelligence, Application Traffic Insight, Client-Side Defense
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Amazon Web Services, Inc. | Cloud services hosting. | United States |
| Okta | Identity as a service and access authentication. | United States |
| Google Cloud | Hosting and storage. | United States |
| Microsoft Corporation | O365 productivity software. | United States |
| ZenDesk, Inc. | Customer support ticket tracking. Decommissioned in December 2024. | United States |
| Salesforce Service Cloud (SFSC) | Customer support ticket tracking. | United States |
| Accenture, Inc. | Provide personnel to assist with support services. | United States, India |
| CommVault Systems Inc. | System backups | United States |
| Tines Security Services Limited | Customer support ticket automation | Ireland |
NGINXaaS
| Entity Name | Purpose | Entity Country |
|---|---|---|
| Microsoft Corporation | Azure Hosting | United States |
| Amazon Web Services, Inc. | Cloud services hosting. | United States |
| Google Cloud | Hosting and storage. | United States |
F5 AI Guardrails, F5 AI Red Team
| Entity Name. | Purpose | Entity Country |
|---|---|---|
| Amazon Web Services, Inc | Hosting Service | United States |
F5 Affiliates
The sub-processors for the SaaS Offerings also include F5 Affiliates.
| Country | Entity Name |
|---|---|
| Argentina | F5 Networks De Argentina SRL |
| Australia | F5 Networks Australia Pty. Limited |
| Austria | F5 Austria GmbH |
| Bangladesh | F5 Networks Bangladesh Ltd. |
| Belgium | F5 Networks Belgium BVBA |
| Brazil | FCinco Representacoes Do Brasil LTDA |
| Canada | F5 Networks Canada Ltd. |
| Chile | F5 Networks Chile Limitada |
| Colombia | F5 Networks Colombia S.A.S |
| Croatia | F5 Networks Zagreb LLC |
| Czechia | F5 Czech Republic s.r.o. |
| Denmark | F5 Networks Denmark ApS. |
| Egypt | F5 Support Services (Egypt) |
| Finland | F5 Networks Finland Oy |
| France | F5 Networks SARL |
| Germany | F5 Networks GmbH |
| Hong Kong | F5 Networks Hong Kong Limited |
| India | F5 Networks India Private Limited |
| India | F5 Networks Innovation Non-SEZ Private Limited |
| India | F5 Networks Innovation SEZ Private Limited |
| Ireland | Calypso Ireland |
| Ireland | NGINX International, Let. |
| Israel | F5 Networks, (Israel) Ltd. |
| Italy | F5 Networks SRL |
| Japan | F5 Networks Japan GK |
| South Korea | F5 Networks Korea Ltd. |
| Malaysia | F5 Networks Malaysia Sdn. Bhd. |
| Mexico | F5 Networks Mexico S de RL de CV |
| Morocco | F5 Networks Morocco |
| Netherlands | F5 Networks Benelux B.V. |
| New Zealand | F5 Networks New Zealand Limited |
| Peru | F5 Lima S.A.C |
| Philippines | F5 Networks Philippines, Inc. |
| Poland | F5 Networks Poland sp. z o.o. |
| Singapore | F5 Networks Singapore Pte Ltd |
| South Africa | F5 Networks South Africa |
| Spain | F5 Networks Iberia SL |
| Sweden | F5 Networks Sweden Aktiebolag |
| Taiwan | F5 Networks Taiwan Company Limited |
| Turkey | F5 Networks Turkey Teknoloji Limited Sirketi |
| United Kingdom | F5 Networks Ltd |
| United States of America | F5, Inc. |
| United States of America | F5 Government Solutions LLC |
Note: You can subscribe to RSS Feeds to receive alerts whenever information on processing and sub-processing is updated.
On this page:
- Objective
- Acronyms for F5 Distributed Cloud Services
- Processing, Storage
- Bot Defense
- Data Intelligence
- Client-Side Defense
- Application Traffic Insight
- F5 Distributed Cloud L7 DDoS, WAF, API Protection, CDN and App Connect
- F5 Distributed Cloud L3/L4 DDoS
- F5 AI Guardrails, F5 AI Red Team
- TAM Locations
- SOC Locations
- Sub-Processors
- F5 Distributed Cloud (DDoS Protection, CDN, WAAP, AI Assistant)
- Bot Defense, Data Intelligence, Application Traffic Insight, Client-Side Defense
- NGINXaaS
- F5 AI Guardrails, F5 AI Red Team
- F5 Affiliates