#Cells and Data

Status: Available. Cells, their data boundaries, and the disclosure log of personal data; the GET /disclosures method is Planned.

Purpose: which cells exist, which address to send requests to, what "a key of one cell" means, and how responsibilities for personal data are divided.

#Three cells

The platform runs as three independent production cells. Each has separate servers, a separate database, separate secrets, and its own legal entity. The data of one cell is not visible in another.

The cell in which you are registered determines:

• the address of the API, the widget, and the loader;
• the currency of the wallet and of paid operations (RU: rubles, EN: pounds, ID: rupiah);
• the legal entity with which the contract is concluded;
• where your data is physically stored.

A page language is not a cell. The ID cell's site serves pages in Indonesian, English, and Russian. Do not determine the cell by language: use the address you use to sign in to the dashboard, or the prefix of your key.

#A key belongs to one cell

A key works only at the address of the cell where it was issued. The prefix shows the cell:

A key cannot be moved to another cell. If you have accounts in several cells, they are independent accounts: each cell has its own integrations and its own keys.

#The wrong_cell error

If you call the EN cell's API with an RU key, you get:

HTTP/1.1 401 Unauthorized
Content-Type: application/problem+json
X-Request-Id: req_EXAMPLE0002

{
  "type": "https://wfacademy.org/developers/errors#wrong_cell",
  "title": "Ключ принадлежит другой ячейке",
  "status": 401,
  "code": "wrong_cell",
  "detail": "Этот ключ выпущен в другой ячейке. Используйте адрес из поля correct_base_url.",
  "correct_base_url": "https://formula-cream.pro/api/public/v1",
  "request_id": "req_EXAMPLE0002"
}

What to do: take the address from the correct_base_url field and fix the base address in your configuration. If you serve tenants of several cells, store "key and base address" pairs together and derive the address from the key prefix (sap_<cell>_…).

#Data storage and responsibility

#Personal data in the RU cell

Restricting a key to one cell guarantees that the platform stores RU data in Russia. It does not prevent you from retrieving data with a request from a Russian address and forwarding it abroad: from the moment of disclosure, responsibility for compliance with the personal data law rests with the tenant as the data controller.

The API endpoints that carry personal data (conversations, messages, leads, contacts) are open in all cells. In the RU cell, additional conditions apply to scopes with personal data (conversations:*, leads:*):

#Transferring personal data to external systems

Connecting an external CRM or a webhook with include_pii: true is a transfer of personal data to a third party at the tenant's decision. For it:

• the tenant specifies the hosting country of the external system and the basis for the transfer;
• on RU, personal data is transferred only to recipients hosted in Russia: if another country is specified, the conversations:* and leads:* scopes and include_pii are not granted to the integration, and the refusal is 403 pii_transfer_not_allowed;
• a disclosure record goes into the disclosure register (integration, list of fields, basis, country, time).

For details, see Transferring personal data.

#Personal data disclosure log

Every disclosure of personal data through the API (a response with a contact, an event with include_pii: true) is recorded as a log row: who (integration and key), what (data type), how many records. The values themselves are not written to the log.

The log is visible to the tenant in the dashboard and through GET /disclosures (a cursor-paginated list, Conventions). It is retained for 3 years.

#What the platform does with personal data by default

• Texts sent to language models go through personal data masking (phone, email, card, messengers, passport, SNILS, INN, names, and addresses are replaced with placeholders).
• Webhook events are "thin" by default: they contain only identifiers and a type, and personal data is requested separately with a key; the include_pii subscription flag includes it in the event explicitly.
• Request logs contain no request or response bodies.

#Retention periods for service data

Retention periods for the conversations, leads, and contacts themselves are determined by the tenant's settings and the contract.

#What differs between cells

The shape of requests, errors, and webhooks is the same in all cells. Only the addresses, currencies, and personal data conditions differ.

#Notes

• If you work with several cells, keep separate integrations, keys, and webhooks for each.
• Webhook events are sent from the cell where the tenant resides; the receiving side must not treat the sender's address as constant. Rely on the signature (Webhooks).