A global payroll platform must keep certain data within specific jurisdictions. What does that force into the architecture?

What it forces

• Region as a first-class dimension from the first row of data. Retrofitting it means touching every table and every query, and it is among the genuinely painful migrations — while an unused column costs nothing.
• Regional deployment of everything that touches the data: storage, compute, backups, logs, telemetry and analytics. The logs and the telemetry are the ones most often missed, and they routinely contain the data the residency rule covers.
• A routing layer resolving the entity to its region before any data access, with the placement carried through the request context.
• Regional independence of the processing, since a regional pipeline calling a central service that receives the data has moved the data.
• Explicit handling of anything genuinely global — the authoritative identity, aggregate reporting, cross-region operations — with a documented lawful basis for whatever crosses.

What it costs

The efficiency of pooling. A global fleet with pooled capacity becomes several regional fleets each needing its own headroom, its own operational attention and its own failure modes. That cost is real and proportional to the number of regions, which is why it should be a priced tier rather than offered uniformly.

And cross-region operations become genuinely hard. A report spanning regions, a customer with employees in several jurisdictions, an investigation requiring correlated data — each needs an explicit mechanism.

The distinction that must be made precisely

Residency, sovereignty and transfer restriction are different requirements. Residency says where the data sits; sovereignty concerns which jurisdiction's authorities can compel access, which is affected by the provider's own jurisdiction regardless of where the servers are; transfer restriction governs movement.

Conflating them produces an architecture that satisfies the easy one and not the one that was actually required — and which of the three applies is a legal question that must be answered before the design.

The payroll-specific complication

A single employment relationship touches several jurisdictions: the employer's, the employee's, and sometimes the payment rails'. Which jurisdiction's rules govern which part of the record is a legal determination, and the architecture must be able to express a record whose components are governed differently — which is not something a single regional partition supports.