Live BearScope tenant data is hosted in the verified US East deployment. Any different residency, backup, or transfer requirement is scoped and documented before provisioning.
The live application sets tenant context before governed queries run, and row-level security limits tenant-owned tables at the database layer.
Where managed action execution is enabled, the supported path records the request, policy decision, and reported outcome. A reversal is a separate compensating action only where the connected system supports one.
For the full picture, including how trust fails closed and how receipts work, read the trust page.