Data residency
hlix runs in the EU. The control plane that serves the API and drives orchestration, the Workspace data behind it, and every project’s Coding Workspace are all hosted in the European Union. This page says exactly what that covers, and — more usefully — what it does not.
When this matters to you
Section titled “When this matters to you”- You are answering a client’s data-protection questionnaire before signing.
- You need to say where a customer’s source code is stored and executed.
- You are deciding which model providers your Workspace may use.
- You need to know what survives deleting a project.
Prerequisites
Section titled “Prerequisites”None. This page describes the hosted platform; there is nothing to configure to get EU hosting, and no region selector.
What is in the EU
Section titled “What is in the EU”| Component | What it holds | Location |
|---|---|---|
| hlix’s control plane | The API, orchestration, integrations and scheduling | EU |
| Your Workspace data | Projects, cycles, tasks, messages, agent memory, encrypted secrets and the audit log — isolated per tenant | EU |
| Your Coding Workspaces | Each project’s saved environment (no secrets), and the short-lived, isolated cloud sandboxes started from it for every task, review, preview build and terminal session — each with a working copy and the project secrets written into it on start | EU |
| Hosted previews | Each merge’s built site files, or the preview app’s container, private to people who can see the project | Stored and run in the EU; requests pass through a global network that checks access |
| The dashboard and these docs | Static application and documentation assets, served from a global network | Served worldwide, hold no Workspace data |
There is no region selector, because there is no second region.
Where your code runs, and where it never runs
Section titled “Where your code runs, and where it never runs”Agent-generated code executes only inside the project’s own Coding Workspace — short-lived, isolated cloud sandboxes, one per job, each deleted when its job ends.
It never executes on hlix’s own servers. The platform refuses to start in any configuration that would run agent code alongside its own services and credentials.
Your machine never runs it either. Import and environment discovery read your repository and record evidence; they do not execute setup commands. Those commands run later, inside the sandbox. Import trust model covers that boundary in full.
The boundary your data does cross
Section titled “The boundary your data does cross”This is the one place your content leaves, and it is under your control:
- Model selection is a Workspace setting, per agent role, with per-project overrides.
- You can bring your own OpenRouter key, so inference bills to and runs under your own account and its terms.
- The coder you choose runs inside the sandbox and reaches its model through hlix on the same basis.
If a client engagement constrains where prompts may be processed, that constraint is satisfied by choosing providers and endpoints that meet it, not by hlix’s own hosting.
Secrets are stored, never committed
Section titled “Secrets are stored, never committed”Project credentials are encrypted at rest in your Workspace data and written into each of the project’s sandboxes on start, for authorized work, and never into its saved environment. Three independent layers stop them entering a commit, and tokens are never passed on a command line. Secrets & protected files has the full path, including one limit to be aware of: encryption at rest is not end-to-end encryption, because hlix must decrypt a value to run your project with it.
What deletion actually removes
Section titled “What deletion actually removes”- Deleting a project removes the project and its data and deletes its saved environment. Any of its sandboxes still running are deleted when their job ends, or by automatic cleanup shortly after.
- An idle project keeps only its saved environment. Its sandboxes exist only while a job runs, so nothing of the project sits in a running machine between jobs. See Reliability & maintenance.
- Records expire on a schedule: the audit log is kept 24 months, the activity feed 6 months, execution logs 30 days.
- Anything you pushed to your own Git remote is yours and is untouched by any of the above.
If a residency question does not have an answer here
Section titled “If a residency question does not have an answer here”- “Which region, exactly?” The EU. hlix does not publish a finer-grained location, and there is no per-Workspace choice to make.
- “Can I self-host it?” No. hlix is a hosted product; there is no on-premises or bring-your-own-cloud deployment.
- “Does my code leave the sandbox?” Only in two ways you control: to your Git remote if the project has one, and to your chosen model provider as part of a prompt.
- “Where is the model running?” With the provider you selected. Ask them, and pick accordingly — see the caution above.
- “Is there a status page or an uptime commitment?” Not a published one. What exists is described in Reliability & maintenance.
Where to go next
Section titled “Where to go next”| If you want to… | Read |
|---|---|
| See how one Workspace’s data is kept from another’s | Tenancy & isolation |
| Follow a credential from your laptop to the sandbox | Secrets & protected files |
| Understand where execution happens | The Coding Workspace |
| Choose which coder and model run your work | Connect your agents |