Residency, transfer, and the questions that follow

At rest: which storage, in which region. In transit and in use: which systems process it, and where those run. And the one that gets missed — telemetry, logs, error reports and support access, which frequently leave a region that the primary data never does.

Ask the third question explicitly of any hosted service. A vendor can hold your documents in-region and still have support engineers elsewhere able to see them, and that is a fact about the arrangement rather than a defect in it.

Deploying into your own cloud account in a chosen region gives you control and a location. It does not by itself make the arrangement domestic: the provider is still a processor, its own supply chain still exists, and the contractual questions still have to be answered. Module 03 lesson 02 made the same point from the architecture side; here it is the paperwork side of it.

Write down which of the three “wheres” each design decision fixes, and which it leaves open. Most disputes in a security review are two people answering different ones of the three.

The transfer question does not have one universal form. In some jurisdictions there is a statutory mechanism to satisfy; in others the relevant provision is not in force, and the work becomes contractual and evidential instead — due diligence, terms modelled on the regulator’s published clauses, and a security assessment of the receiving environment.

Do not carry an answer across a border. Read the jurisdiction page for the customer you are serving, note the status of each instrument and its date, and treat anything you learned elsewhere as a question rather than an answer.