Data Residency

What is data residency?

Data residency is where your data is physically stored: the country or region of the data centers that hold it. When a vendor offers "EU data residency," it means your data is stored on servers in the EU.

It is often a choice you make, not a legal rule. A company may pick a region to meet a customer's request, to speed up the service, or to make privacy reviews simpler.

Three terms get mixed up:

• Data residency: where the data is stored, often by choice.
• Data localization: a law that requires data to stay in a country. See the section below.
• Data sovereignty: the idea that data is subject to the laws of the country where it sits, or of the company that controls it. See data residency vs data sovereignty.

Residency does not mean the data never leaves the region. Support staff, subprocessors and backups can sit elsewhere. Read the scope of the promise.

What it looks like in a vendor's terms

A typical clause reads like this:

If Customer selects a data residency region, Provider will store In-Scope Customer Data at rest in that region. In-Scope Customer Data excludes account information, logs, analytics and data processed by Third-Party Integrations. Provider and its Subprocessors may access Customer Data from other locations to provide support and security.

• "At rest": covers stored data, not data moving through networks.
• "In-Scope Customer Data": only some of your data is covered. The exclusions list matters.
• "Access... from other locations": people in other countries can still see your data, even if storage stays put. That access needs its own legal basis.

Atlassian's data residency guide shows how scope works in practice. It covers in-scope app data, while user account details such as names and email addresses are "considered out-of-scope for data residency." App analytics, data in transit, cached content and app, audit and operational logs are also excluded.

A real change we caught

Venpo flagged this change: Stripe added Microsoft Azure and Snowflake as cloud subprocessors. A new cloud subprocessor is the kind of change that can affect where data is stored or processed, so it is worth checking against any residency commitment you rely on.

Why it matters to you

Your own customers may ask for it. Enterprise buyers and EU customers sometimes require that their data stay in a region, and they may write it into your contract. That promise only holds if each vendor behind you keeps it too.

Residency is not the same as legal compliance. The GDPR does not require data to stay in the EU. It allows transfers abroad when conditions are met, under Article 44 and the articles after it. So an EU region is a choice, while the real rule is to have a valid transfer route, such as standard contractual clauses, for any data that leaves.

Connected services can sit elsewhere too. Slack's supplemental terms say services that link Slack and Salesforce run on separate infrastructure that may "be hosted in different physical locations."

What to check

• Which regions the vendor offers, and on which plans.
• Which data is in scope and which is excluded, such as account details, logs, backups and analytics.
• Where support staff and subprocessors access data from. Compare the subprocessor list against the region you picked.
• Whether AI features or integrations send data outside the region.
• Whether the vendor must notify you before moving data or adding a subprocessor in a new country.

Data Localization

Data localization is a legal requirement that certain data be stored, and sometimes processed, inside a specific country. Unlike data residency, it is not a choice. The law requires it.

Localization rules differ by country and by sector, so the details depend on where you sell and what data you handle. Ask local counsel which rules apply before you promise a customer anything.

The GDPR is not a localization law. Its transfer rules let data leave the EU when a safeguard is in place, as Article 44 sets out. A localization law can go further and bar the transfer, or allow it only after approval.

If you sell into a country with such a law, check two things with each vendor. First, whether it offers storage in that country. Second, whether any of its subprocessors, support teams or backups would move the data out. A residency setting may not be enough if the vendor still processes data elsewhere.

How Venpo helps

Venpo monitors your vendors' subprocessor lists, DPAs and privacy policies and emails you when a new subprocessor, location or residency term appears. Each alert explains what changed and why it matters for where your data lives.