A communications platform must keep customer data in-region for several markets. What does that actually require?
Show the full answer Hide the answer
The requirement is broader than storage
Residency is commonly read as "the database is in the region". The obligations usually extend to processing, backups, disaster recovery copies, logs, telemetry, support access and any derived data — and each of those is a separate place data leaks out of a region without anyone intending it.
What it requires architecturally
- Regional data stores with routing that guarantees the right one, based on the customer's assigned region rather than on the user's current location, since a user travelling must not have their data relocated.
- Regional processing, so real-time media, transcoding or analytics happen in-region rather than in a central cluster.
- Backups and disaster recovery within the region or a permitted set, which constrains the DR design substantially and is frequently discovered after the DR plan exists.
- Logs and telemetry scrubbed or kept regional, since observability pipelines are the most common unintentional exfiltration path — a stack trace containing a customer identifier flowing to a central logging system is a transfer.
- Support access controls, because a support engineer in another region viewing customer data is a transfer regardless of where the data is stored.
The centralised parts that remain
Identity, billing, configuration and the control plane are usually global. The workable split is a global control plane with regional data planes, provided the control plane holds only metadata that is not itself regulated — which requires being precise about what counts as personal data in the control plane rather than assuming it holds none.
The cost to state plainly
Every region multiplies infrastructure, deployment, monitoring and on-call. Regional isolation is expensive and it is the mechanism that actually satisfies the requirement — designs that keep one global system and add access controls generally do not, because the data still moved.