HiveGrid-Wireframes/hivegrid-cloud/docs/deployment-region-provider-pinning.md

Deployment Region And Provider Pinning

This document records the deployment-region and provider policy for hosted environments. The historical filename is retained for link compatibility; the policy language is provider- and region-neutral. It is an operator contract: keep raw secret values, account IDs, customer data, provider payloads, and full environment dumps out of docs, tickets, logs, and CI output.

Runtime Policy

Surface	Required setting	Operational rule
AI primary	Provider selected by AI_PROCESSING_REGION and deployment record	Primary generation uses the approved AI adapter for the deployment.
AI fallback	Provider-specific region markers such as SCALEWAY_REGION	Fallback generation must use the provider endpoint and region approved in the deployment record.
Additional AI fallback	Provider approved by deployment record	Production enablement requires provider/account evidence before traffic is routed.
Transactional mail	Mailjet (Sinch), EU-hosted (Frankfurt/Belgium); no region env var	Outbound mail requires confirmed processing posture and approved subprocessors for the deployment.
Billing	Billing provider with STRIPE_ACCOUNT_COUNTRY when Stripe is used	Billing integration requires an account country approved for the deployment.
Subprocessors	Approved subprocessors only	Any provider contract or add-on that routes customer data outside the approved deployment policy blocks production enablement until approved or replaced.

Required Region Variables

These keys are deployment-policy markers. Include the keys that apply to the selected providers in production secret/config stores and deployment review evidence:

AI_PROCESSING_REGION=<deployment-region>
SCALEWAY_REGION=<provider-region>
STRIPE_ACCOUNT_COUNTRY=<billing-account-country>

The keys are not secrets. They are drift markers for deployment review and CI/env inventory checks. Do not treat them as runtime proof by themselves; production evidence must still come from provider account settings, contracts, and approved subprocessors.

Provider Evidence

Provider endpoint and region settings must be reviewed against the deployment record. Do not infer data residency or processing posture from a hostname alone.

Mailjet remains the current transactional email provider. Production mail must not be enabled until account/contract evidence confirms the approved processing posture and subprocessor list for the deployment.

Stripe remains the current billing provider. Stripe country requirements differ by account country, so deployment review must confirm the approved account country before production billing is enabled.

Verification Notes

• Run pnpm run verify:env-drift after editing env examples or catalog entries.
• Run the standard CI baseline gates before merging deployment-region/provider changes.
• Record only pass/fail status, key names, region labels, and provider/account evidence labels. Never paste secrets, account IDs, raw provider exports, or customer data.