Identity Protection Data Residency

SlashID stores two kinds of data, with different residency rules:

• Identity management data (organizations, their configuration, and the hashed lookups described in Cross-region Replication) is replicated globally, so it stays available when a region is down.
• Identity protection data (the connections you onboard, the identities, credentials and resources they discover, their events, detections and the analytics derived from them) is not replicated across regions. It is stored in exactly one NHI data region per organization.

The NHI data region

Every organization has an NHI data region, exposed as nhi_region on the organization in API responses. The region is chosen when the organization is created and cannot be changed afterwards.

• A new organization is homed in the region you choose at creation, or in the deployment's default (core) region when you do not choose one.
• A suborganization is homed in its parent organization's region unless you choose another one when you create it.

Available regions

The regions an organization can be homed in are returned by GET /nhi-regions. The endpoint accepts a session token or an API key; with an API key, pass your organization's ID in the SlashID-OrgID header.

{
  "result": {
    "core": "europe-belgium",
    "regions": ["europe-belgium"]
  }
}

regions is the exact set an nhi_region may name, and core is the default. A request that names any other region is rejected with 400 Bad Request. Region names are drawn from this list:

nhi_region	Location
europe-belgium	Europe (Belgium)
europe-england	Europe (England)
us-iowa	US (Iowa)
asia-japan	Asia (Japan)
australia-sydney	Australia (Sydney)

Only the regions GET /nhi-regions returns are open for new organizations.

Choosing a region

• Console sign-up and AWS Marketplace sign-up: when more than one region is available, the sign-up form shows a Data region field. With a single region there is nothing to choose and the field is not shown.
• Suborganizations: the console's Create a new suborganization dialog shows the same field, pre-selected with the parent organization's region. Through the API, set nhi_region on POST /organizations/suborganizations.

Region refusals

When a request cannot be served because of where an organization's data lives, the error carries a machine-readable code next to the human-readable message. Match on code; the message text may change.

code	HTTP status	Meaning
unserved_org_region	503	The organization's data is homed in a region this deployment does not serve.
region_route_missing	502	The organization's home region is not reachable from here.
wrong_region	—	Sent to a region other than the organization's home region. SlashID forwards such requests automatically; the code is listed for completeness and is not returned in practice.

{
  "errors": [
    {
      "message": "no route from this instance to region 'us-iowa'",
      "code": "region_route_missing"
    }
  ]
}

These refusals are not transient: retrying the same request is not expected to succeed.

Internal messaging

SlashID's services exchange work over internal message topics. An organization's identity protection data is homed in its NHI data region, and the messages that carry it are processed there. Messages that carry only organization metadata (identity management events) use global topics, consistent with the global replication of identity management data. Aggregate usage counts for billing are also reported through a global topic.