Data residency used to be a procurement answer. A customer asked where their data would live, the vendor said the data would live in their region, everyone pointed at a storage bucket with a regional name, and the clause was satisfied. It was true as far as it went, and it did not go far.
What has changed is that the question is now asked about the whole system rather than the database. Where are the backups. Where does the logging pipeline terminate. Which region processes the queue. When a support engineer opens a session at three in the morning, whose jurisdiction are they sitting in. Each of those has an answer, and in most architectures the answer is not the one on the contract.
The primary store was never the hard part
Pinning a database to a region is straightforward and every cloud provider sells it. The difficulty lives in everything that reads from it. Observability platforms aggregate globally by design, which is what makes them useful. Analytics warehouses consolidate so the numbers can be compared. Queues and caches sit wherever latency wanted them. Machine learning pipelines pull training data to wherever the accelerators are.
Every one of those is a copy, and a copy is residency-relevant even when it is transient and even when nobody thinks of it as storage. Teams doing this seriously usually discover the problem in the logging layer first, because a log line containing a customer identifier is customer data, and the log line went wherever logs go.
Support access is the piece with no technical fix. A follow-the-sun rota is a business advantage and it means somebody in a different jurisdiction can see production data. The options are all costly: regional support teams, break-glass workflows with per-incident approval, or tooling that redacts by default and reveals only on escalation. Each is real work, and none of them is a setting.
The architectural consequence is a genuine reversal of the last decade's direction. Consolidation was the whole point — one warehouse, one observability stack, one control plane — because it made everything cheaper and more legible. Residency pushes back toward regional isolation with a thin coordinating layer, which costs more to run and much more to operate, and which is the same instinct now driving companies to move workloads back off the cloud where the economics stopped working.
It also reshapes buying. A company that owns more software than it can account for has a residency problem in every one of those tools, and most vendors answer the question with the same paragraph the industry used five years ago. Procurement teams have started asking for the deployment diagram rather than the assurance, which is a harder question and the only one that distinguishes between vendors.
The honest position for most companies is that they are partially compliant and know it. The primary store is where it should be. The logs, the analytics and the support path are being worked through in order of how likely each is to be asked about, which is a reasonable way to spend a limited budget and is not the same thing as the clause being true.
Topics technologycloud
