Data residency inside one building

Data residency, as usually practiced, is a promise about geography. The data is in a region. The region has rules. The operator trusts that the region is where the data stayed and that the rules were followed, and asks the provider for a document to that effect.

A facility pool makes residency smaller and more literal. The data lives in the building that produced it, on nodes in the building's own rack, and never crosses the building's own network boundary. When someone asks where the floor's data is, the answer is a room the operator can walk to.

Residency measured in walls, not regions

A Czar Grid serves perception, decisions, and language models to every robot in a facility from inside the facility. The nodes are in the building's rack. The robots reach them over the building's network. Everything the pool receives, produces, or keeps is on hardware the operator owns in a place the operator controls.

That is a different kind of claim from regional residency. A region is a large area administered by someone else, and residency within it is a contractual assurance. A building is a space the operator already secures, with doors, badges, and a network the operator's own staff run. Residency within it is a physical fact the operator can verify by looking.

The things that reside

It helps to be concrete about what is being kept. Camera feeds from the fleet, which show the floor and the people on it. Captures saved from those feeds, which are the hard cases used to adapt the models. Task records from Agency Studio, which show what was authored, who approved it, under what bounds, and every run. Adapted model weights, which are what the site's own captures taught the pool. The decision record, which is the log of what the pool told each robot.

Every item on that list is on the Czar nodes inside the building. On an air-gapped site there is no path for any of them to leave. On a connected site, the declared routes to fleet software, the warehouse system, and the PLCs carry coordination and work, not the floor, and Local Bridge denies every route the site did not declare. What leaves the building: nothing treats each item in turn.

Residency across a Grid

One Czar is a pool for a small floor. Several Czars joined are a Czar Grid, one pool for the whole facility. Operators sometimes ask whether growing from one node to several changes where the data is, since the pool is now distributed.

It is distributed across a rack. The nodes of a Grid are in the same building, on the same facility network, serving the same floor. Adding a node adds capacity in the room; it does not create a second location. The pool's record, its captures, and its adapted weights remain inside the walls that held them when the pool was one node. Residency is a property of the building, and the Grid stays in the building.

Each node that joins attests what it is running first and brings its own provenance record, so the growth of the pool is also on record. Attestation before a node joins a Grid covers that admission.

When an operator has more than one building

Most operators do. A logistics company runs many distribution centers. A manufacturer has several plants. A ports operator may have terminals and inland depots. Residency inside one building then becomes residency inside each building, decided site by site.

Each building runs its own Czar or Grid. Each building's floor data stays in that building. The posture is chosen per site, so one plant can be air-gapped while a distribution center is connected only to its declared systems, and both sit under one subscription for the configured Grid. A mixed estate is the normal condition, and the operations team manages one appliance across all of it. Air-gapped, or connected only to what the site secures describes how the two postures differ in daily use.

What a multi-building operator gains is a simple answer for every site. The data from this floor is in this building. There is no central pool elsewhere that aggregates the estate, and no building's data travels to another unless the operator builds that path itself, outside the Grid, as its own decision.

What residency makes simple

Residency inside one building collapses several difficult questions into easy ones. Where is the workforce footage: in the rack. Where are the adapted models: in the rack. Where is the record of what the robots were told last night: in the rack. Who else can see any of it: nobody who is not inside the building's network.

An auditor asking where the data is can be shown. A partner asking whether their containers appear in anyone else's imagery can be told that the imagery never left the terminal. An employee asking where their shift was recorded can be given the name of a room. These are the conversations residency is supposed to make possible, and they are easier when the region is a building. For the appliance that makes it so, see Czar Grid and Technology.