Data Residency Flag

The flag operates in two primary modes:

• Binary Flag: A simple boolean (true/false or 1/0). If true, the data must not leave the designated jurisdiction. This is the simplest form of enforcement.
• Categorical Flag: A more granular attribute specifying exact jurisdictions (e.g., jurisdiction: DE, jurisdiction: EU-EEA). This allows for multi-region deployments where data can reside in one of several approved locations.

The choice between binary and categorical depends on the complexity of the regulatory environment and the geographic distribution of the infrastructure.

Once set, the residency flag must be cryptographically non-repudiable. Key characteristics include:

• Write-Once, Read-Many (WORM) semantics at the storage layer.
• Integration with Hardware Security Modules (HSMs) to sign the flag at creation.
• Tamper-evident logging: any attempt to alter or strip the flag generates an irreversible audit trail.
• The flag is part of the object's immutable prefix, ensuring it cannot be separated from the payload during replication or backup.

The flag is not passive documentation; it is an active control signal for infrastructure:

• Storage Class Enforcement: Automatically assigns data to geo-fenced S3 buckets or storage volumes.
• Network Egress Gate: Firewalls and API gateways inspect the flag before allowing cross-border data transfer.
• Compute Scheduling: Orchestrators (e.g., Kubernetes) use the flag to schedule processing jobs only on nodes physically located within the permitted jurisdiction.
• Backup/DR Routing: Ensures disaster recovery replicas are created only in-region.

The flag can be applied at multiple levels of data granularity, each with different operational overhead:

• Object-Level: Attached to individual files, database rows, or BLOB storage objects. Offers the finest control.
• Container/Bucket-Level: Applied to an entire S3 bucket or database table. Simpler to manage but less flexible.
• Schema-Level: Defined as a mandatory column in a database schema, ensuring no record can be inserted without a residency designation.
• Stream-Level: Embedded in the headers of streaming data (e.g., Kafka record headers) for real-time enforcement.

A critical characteristic is automatic inheritance. Any derived data—reports, ML training datasets, logs, or aggregated analytics—must inherit the residency flag of the source material.

• Lineage Tracking: Data lineage tools capture the flag's propagation path.
• Conflict Resolution: If two source objects with conflicting flags (e.g., DE and FR) are combined, the system defaults to the most restrictive jurisdiction or raises a compliance exception.
• This prevents data laundering, where restricted data is transformed into an unrestricted format to bypass controls.

The flag serves as the authoritative trigger for crypto-shredding workflows. If a residency violation is detected or a legal hold expires:

• The flag's state change initiates the secure deletion of the associated encryption keys from the key management service (KMS).
• This renders the data cryptographically inaccessible, effectively enforcing residency by making out-of-jurisdiction copies useless.
• The flag remains as a tombstone record for audit purposes, proving the data was properly disposed of.