Where your data is processed
Service infrastructure location, model inference countries, PIPA posture.
PleumRouter's service infrastructure (servers and databases) runs in the Seoul region of South Korea. Model inference, however, happens on each model vendor's infrastructure and may be located overseas. This page separates the two — where your account and usage records live is a different question from where your prompts go.
Where are PleumRouter's servers and databases?
In the Seoul region of South Korea. The frontend and API reverse proxy run on Vercel (icn1), the database on Supabase (ap-northeast-2), and the API servers and Redis on Alibaba Cloud (ap-northeast-2). Account data, usage records, consent history and the billing ledger are therefore stored domestically as their primary location.
Where does model inference happen?
It depends on the model. Global models (GPT, Claude, Gemini) are processed in the US, Qwen and GLM (z.ai) in Singapore, and DeepSeek in China. Even a model from a Korean company may run on overseas infrastructure — Upstage Solar, for example, is processed on US infrastructure. The recipient, country, training-use flag and retention period for each model are published in full in Article 5 of the Privacy Policy.
Can I require inference to stay inside Korea?
Not today, and we do not claim otherwise. There is no option to restrict routing to models that infer only on domestic infrastructure. If you need to reduce cross-border transfer, per-API-key PII masking — which strips detected personal data before the request leaves — is the practical option.
What does PII masking actually cover?
It is a per-API-key option that replaces detected personal data in text before the request reaches the provider. The exact scope and its exceptions — including paths detection does not reach, such as multimodal inputs — are published as-is in the PII masking document. We do not claim it masks everything.
Where is the disaster-recovery infrastructure?
Overseas. Railway is used as disaster-recovery infrastructure for service continuity, with transfer countries Singapore and the United States. Under Article 28-8(1)(3) of the Personal Information Protection Act, the recipient, items, timing, purpose, retention period and refusal method are disclosed in Article 5(5) of the Privacy Policy.
What else leaves the country?
Email delivery (Resend, US), bot mitigation (Cloudflare, global edge), usage analytics (Google Analytics, US) and error tracking (Sentry, US) are processed overseas. Error messages, file names, URLs, user identifiers, API request bodies and prompts are not sent to Sentry.
Summary
| Data | Processing location | Source |
|---|---|---|
| Account, usage records, consent history, billing ledger | Domestic (Seoul region) | Privacy Policy Art. 4 |
| Prompt and response bodies (model inference) | May be overseas, per model | Privacy Policy Art. 5 |
| Disaster-recovery replica | Overseas (Singapore, US) | Privacy Policy Art. 5(5) |
| Email, security, analytics, error tracking | Overseas (US, global) | Privacy Policy Art. 5(5) |
Source: /privacy · /docs/pii-masking · 2026-09-02
This page is a developer-facing summary of the Privacy Policy. The Privacy Policy is the legally binding text and prevails where the two differ.