Overview
Standard organizations share the control-plane database schema and data-plane namespace. Contracted Enterprise organizations can be operator-provisioned into a dedicated Postgres schema or database. Dedicated placement is not self-service.
Authentication, entitlement, usage, SSO, SCIM, heartbeat, and placement control records remain in the shared control plane for every tier. Cloudflare KV cannot currently be pinned to one jurisdiction, and regional compute routing is not offered. Do not interpret database placement as end-to-end data residency.
During a placement migration, tenant operations fail closed with
503 tenant_migrating or 503 tenant_unavailable; clients continue using their last good snapshot. Point-in-time recovery and database row-level security are not part of the current isolation guarantee. Backup retention beyond the standard policy must be explicitly contracted and verified as deployed.
Contact support (hey@useshipd.com) for provisioning, migration scheduling, current restore objectives, and evidence for your contracted placement.
Related: Reliability and data handling · Local evaluation.