- 01Cloud provider residency claims are mostly accurate at the customer-data layer. They are often less accurate or unclear at the support, telemetry, backup, and diagnostic layers — which can matter as much as primary data for regulated workloads.
- 02Verify each layer independently: customer data at rest in-region, customer data in flight (replication, backup), support data (case attachments, screen shares), telemetry + operational metadata, provider personnel access location, sub-processor list with each sub-processor's residency.
- 03Sovereign cloud variants (AWS Sovereign Cloud, Azure Sovereign, GCP Sovereign Controls) make hard residency commitments backed by personnel and operational separation. Appropriate for high-sovereignty workloads; cost more and not always at full feature parity.
- 04External KMS / HYOK gives you a residency-of-key story even when residency-of-data has gaps. Adds latency and operational complexity — use for the highest-sensitivity workloads only.
Cloud providers' data residency claims are mostly accurate at the customer-data layer. They are often less accurate or unclear at the support, telemetry, backup, and diagnostic layers. For regulated workloads, those layers can matter as much as the primary data.
What to verify
- 01Customer data at rest — confirmed in-region
- 02Customer data in flight (replication, backup) — confirmed in-region
- 03Support data (case attachments, screen shares) — confirmed boundary
- 04Telemetry and operational metadata — confirmed handling
- 05Provider personnel access location — confirmed for support staff
- 06Sub-processor list — every sub-processor's residency for each function
Sovereign cloud offerings
Sovereign cloud variants (AWS Sovereign Cloud, Azure Sovereign, GCP Sovereign Controls) make hard residency commitments backed by personnel and operational separation. They are appropriate for high-sovereignty workloads; they cost meaningfully more and are not always at full feature parity. Choose deliberately.
Encryption with customer-held keys
External KMS or HYOK (hold-your-own-key) approaches give you a residency-of-key story even when the provider's residency-of-data story has gaps. They add latency and operational complexity. Use for the highest-sensitivity workloads only.