“Hosted in region” is not the same as “all processing stays in region.” A tenant’s data may appear in a primary database, object store, search index, logs, backups, support tools, analytics and model-provider requests. A useful residency architecture maps every path, identifies who can access it and enforces approved transfers rather than relying on a region label.
Data residency describes where data is stored or processed under a requirement; data localization can impose more specific local-storage constraints. Cross-border transfer rules may apply even when the primary database stays put. A support engineer viewing a record from another country, a vendor log export, a global search index or an LLM prompt can create a different flow that deserves its own assessment.
A global control plane can hold tenant ID, region assignment, feature flags and service health, while content and sensitive records stay in the tenant’s region. Keep the control plane minimal: metadata can still identify people or reveal business activity. Region-aware service discovery should resolve every tenant request to the approved data plane; do not trust a client-supplied region header.
Co-locate relational storage, object storage, search/vector indexes, queues, caches, encryption keys and backups where policy requires. Define whether replicas are synchronous or asynchronous, where disaster-recovery copies live and how restore is tested. A “regional” KMS key does not localize plaintext sent to centralized logs or a global observability vendor.
| Path | Typical hidden copy | Engineering control |
|---|---|---|
| Customer support | Ticket attachment, screen share or copied query result. | Just-in-time access, approval, redaction and audited session. |
| Telemetry | User ID, prompt snippet, URL or exception payload in traces. | Field allowlist, regional sink, short retention and sampling review. |
| Search and AI | Embedding, chunk, prompt or provider-side retention. | Region-bound index, source lineage, endpoint policy and no-training terms. |
| Resilience | Snapshot or backup restored into a different geography. | Approved recovery region, encrypted backup and tested deletion/replay. |
Build a policy decision from tenant contract, data category, purpose, source and destination, recipient, transfer mechanism and effective rule version. For each approved flow, record the legal basis or safeguard reviewed by counsel, retention, subprocessors and onward-transfer limits. Geolocation can be one signal, never the whole decision.
The GDPR treats transfers of personal data to third countries under Chapter V; Singapore’s PDPA has a Transfer Limitation Obligation; China’s PIPL and subsequent CAC rules define outbound-transfer mechanisms and conditions. These are not identical tests. China’s 2024 cross-border data-flow provisions and certification measures effective in 2026 also show why threshold and process details must be checked against current official material. This article is architecture guidance, not a determination that a particular transfer is lawful.
Write tests that assert a tenant cannot read another region, a queue cannot cross a boundary by default, a log filter removes restricted fields and an export is blocked without an approved policy. Test subprocessors and failover regions, not only happy-path API calls. On deletion, find primary rows, replicas, indexes, caches and derived features; document backup expiry and restore-time deletion replay.
I would start with a data-flow register and a tenant-region directory. A provisioning workflow would select a region only after data class, product features, subprocessor availability and recovery constraints are known. An egress gateway would enforce destination policy for exports and external AI calls. A compliance dashboard would expose data stores, transfer edges, policy versions, support access and unresolved exceptions.
Residency is an end-to-end property, not a database setting. Map primary and derived data, human access, observability, backups and model calls. Separate control-plane metadata from tenant content where useful, enforce transfer policy at service boundaries and test restoration and deletion across regions.