Data-residency rules usually focus on where production data lives. They should also cover the security tools, because a SaaS scanner that ingests your source code is a data-export event most reviews miss.
You can pin your production database to a region and still ship your entire codebase to a scanner's cloud on every commit. For sovereign, regulated or defence workloads, that is exactly the exposure residency rules exist to prevent - it is just hiding in the security toolchain.
The clean way to satisfy residency is to remove the export entirely. apPosture is self-hosted and air-gapped capable, with a local model, so your source, findings and evidence never leave your infrastructure. There is no region to choose and no sub-processor to vet for your code, because nothing about it is transmitted.
Only partially. If the tool still ingests your code into a vendor cloud, the code has left your boundary regardless of region. Self-hosted removes the transfer altogether.
The local LLM runs inside your infrastructure, so AI analysis does not create a data-export path either.
From discovery to a proven attack chain. A PoC in your own environment.