How do you make a data residency requirement a structural property rather than a policy?

What is being tested

Whether you can make a regulatory obligation something the system cannot violate.

The architecture

Per-region cells with a thin global control plane.

Each region runs a complete, independent deployment — application, database, cache, search, analytics. Tenants are pinned to a region. The global layer holds only routing information — which tenant lives where — plus billing and provisioning, and is designed to hold nothing the regulation covers.

Data cannot leave the region because there is no path for it to leave. That is what makes it structural, and it is far easier to demonstrate to an auditor than row-level filtering in a shared database, which requires proving that every query includes the filter.

What makes it work

Tenancy resolved at the edge, before anything touches data — from the hostname, the token, or a globally replicated directory holding no personal data.

Every copy accounted for. This is where residency claims usually fail: backups, replicas, logs, search indexes, the warehouse, analytics tools and third-party processors are all copies, and each must stay in region. A data flow diagram with jurisdictional boundaries marked is what makes this checkable.

Policy enforcement at the infrastructure layer — approved regions only, enforced by cloud policy, so a misconfiguration cannot create a resource in the wrong place.

The control plane examined carefully, because it is where residency quietly breaks. If it holds anything the regulation covers, the claim fails.

What it costs

Infrastructure multiplied by regions for the same total traffic. Deployments rolled per region. Cross-region features become per-region or operate on aggregated data. Genuine difficulty producing global aggregates.

The first question to ask

Which level of obligation applies? Residency (stored in the jurisdiction), operational sovereignty (only in-jurisdiction personnel may access, including provider support), or full sovereignty (operable independently of a foreign provider).

The architectural implications differ enormously, and organisations frequently over-interpret — forgoing managed services where residency alone would have sufficed.

The general principle

Enforce at runtime, do not document. A model in a spreadsheet describes what was intended; one in the request path describes what happens. Only the second survives an audit.