Data Residency

The core principle is that data at rest must reside on physical storage media located within the designated jurisdiction. This is enforced through regional cloud endpoints and compliance zoning.

• Primary Data: All production databases and object storage are pinned to a specific region.
• Backup & DR: Replicas and backups must also remain within the same or an approved secondary in-country zone.
• Metadata: Logs and monitoring data are often subject to the same residency rules as the primary data.

Residency extends beyond storage to computation. Data plane isolation ensures that any service decrypting or transforming data operates on in-scope infrastructure.

• Compute Affinity: Virtual machines and containers processing protected data are scheduled on hardware within the jurisdictional boundary.
• Key Management: Customer-Managed Keys (CMK) and Hold Your Own Key (HYOK) models keep cryptographic materials inside the boundary, preventing external decryption.
• Serverless Constraints: Functions-as-a-Service must be configured with regional execution limits.

Technical controls prevent unauthorized cross-border data movement. Egress filtering and Data Loss Prevention (DLP) systems monitor outbound traffic.

• Geofenced API Gateways: Inspect source IPs and block requests originating from outside approved jurisdictions.
• Data Residency Locks: Cloud provider APIs programmatically prevent storage bucket replication to other regions.
• Dynamic Data Masking: Obfuscates sensitive fields in query responses based on the user's location, preventing accidental exposure to foreign viewers.

Data residency is driven by national laws that dictate where data must be kept. It is distinct from data sovereignty (legal authority) and data localization (strict prohibition on transfer).

• GDPR Influence: While not a strict localization law, GDPR's transfer restrictions heavily incentivize EU residency.
• Sectoral Laws: Financial services and healthcare often have specific, stricter residency mandates.
• Transfer Mechanisms: Standard Contractual Clauses (SCCs) and Transfer Impact Assessments (TIA) are legal tools used when any cross-border access is unavoidable.

Compliance requires demonstrable proof of residency. Immutable audit logs and provenance metadata provide a tamper-proof chain of custody.

• Data Lineage: Tracks the complete lifecycle of data, proving it never left the jurisdiction during transformation.
• Cryptographic Attestation: Hardware-based Trusted Execution Environments (TEEs) can provide signed proof of the geographic location of a compute node.
• Continuous Monitoring: Automated tools scan configurations to detect residency violations, such as a database replica accidentally created in a foreign region.

A common implementation pattern is regional sharding, where a database is partitioned by a geographic key to guarantee isolation.

• Shard Key: A user's country of record determines which regional database stores their data.
• Application Logic: The application layer routes all queries for a user to their assigned regional shard.
• No Cross-Shard Joins: The architecture explicitly prevents queries that would join data across different jurisdictional shards, enforcing isolation by design.