Your machine's address never leaves our infrastructure

Letting a customer require EU-only processing means the network has to know where each machine is. There is a well-trodden way to do that: send the address to a geolocation API and read the country back. It takes an afternoon.

It also means handing a third party the address of every machine on the network, continuously, forever — which is exactly the data we tell people we do not collect. So we did the other thing.

The lookup runs on our own hardware

A small service reads a location database from local disk and answers questions about addresses. Nothing leaves the building. There is no API key, no vendor, no rate limit and no third party accumulating a map of who hosts for us and where they live.

The data is DB-IP Lite — country, city and network operator, published under a Creative Commons licence with no key and no registration. It is refreshed monthly by our pipeline.

What we keep, which is almost nothing

An IP address is personal data, and "we do not keep what we do not need" has to apply to our hosts as much as to our customers. So the address is resolved and then discarded. What is stored against a machine is a two-letter country code and a salted hash that is only ever compared against itself, so we can notice when a machine moves country and re-place it.

The lookup service does not write addresses to its logs either. That sounds obvious and is easy to get wrong: the standard request-logging format includes the query string, and the query string is where the address is. The service logs paths only, and there is a test that fails if anyone changes it back.

The host is never asked

The important design decision is not where the database lives — it is that the machine does not get a say. mahout does not send a country and there is no field for it to send one in. A host able to declare its own region:eu would turn the guarantee into an honour system, and an honour system is what you already have from a vendor's marketing page.

It also fails closed. No database, an address that cannot be resolved, a country we do not recognise — all produce no region tag, and a machine without one never receives work that requires it. We would rather lose the capacity than route regulated traffic on a guess.

What a host sees

Their own placement, on their machine's page in the dashboard, taken from the same tags the scheduler routes on. And from the machine itself, mahout can ask the service where it appears to be — that endpoint answers only about the caller's own address, never about anyone else's, which is the one question an outsider has a right to ask.

Precisely what this proves

That the machine which produced your tokens presented an address allocated to an EU or EEA country, and that the scheduler refused to route your job anywhere else.

Not that the hardware is physically there — address geolocation is evidence, not attestation. We would rather tell you where the edge of the guarantee is than let you find it during an audit. The full reference is in the knowledge base.