Data Residency and Jurisdiction: Why In-Country Storage Is Not the Whole Answer

Choosing a storage region answers exactly one question, which is where the bytes sit when nothing is happening to them. A regulator or a legal team reviewing an AI system is asking several more, and most of them are not about geography. They want to know which country's courts can compel the provider to produce the data, which people can reach a running system and from where, and which copies exist outside the region you picked. A tenant pinned to Frankfurt can answer the geographic question perfectly and leave every other one open.

That gap is where residency projects fail review. The vendor says truthfully that data is stored in the EU, the buyer hears that everything stays in the EU, and nobody has asked where inference runs, where the vector index lives, where support engineers sit, or where the failover replica lands. This article takes apart both halves of the question, the technical one and the legal one, and ends with the architectures that answer jurisdiction rather than geography. It sits under our guide to on-premises AI, which covers the wider deployment decision this feeds into.

Five places your data can be, and only one is the storage region

Residency is a property of every component that holds or handles content, and those components are often in different places. Treat what follows as five questions with five separate answers, because a vendor can satisfy the first while the other four sit somewhere else.

Storage residency

Where the primary copy is written. This is what region selection answers, and it is the answer most likely to cover the object store alone. A media platform holds originals in a customer-selected European region while its content delivery network caches renditions at edge nodes worldwide for playback speed, which puts viewable copies in a dozen countries nobody enumerated. Derived artefacts follow the same pattern, because thumbnails, transcodes, extracted text and search indexes are often written by services carrying their own default region that never entered the conversation.

Processing residency

Where content is loaded into memory and operated on. Storage and processing are separate architectural decisions, and vendors often make them differently, because storage is cheap to distribute and processing is expensive to duplicate. The failure mode is that the primary copy never moves while the entire content does. A file stored in Dublin gets pulled to a transcription farm in a US region, processed there, and the transcript written back. Ask an auditor whether the audio was transferred and the answer is yes. Ask the storage dashboard and it shows one region.

Support and administrative access

Who holds a route into the running system, and from which country they use it. European reviewers are alert to this one, and the guidance is explicit. The EDPB's Guidelines 05/2021 on the interplay between Article 3 and Chapter V, adopted in their current form on 14 February 2023, state that remote access from a third country counts as a transfer "even if it takes place only by means of displaying personal data on a screen, for example in support situations, troubleshooting or for administration purposes". The guidelines work the point through as a named example: a processor outside the EU that remotely accesses data stored in the EU for support purposes is receiving a transfer under Chapter V. The failure is mundane. A support engineer in a third country needs to reproduce a defect, opens the customer's tenant through a jump host, and views the document that triggered it. Nothing was exported by any definition the vendor uses internally, and a supervisory authority reviewing the same event sees personal data made available to someone in a third country.

Backup and disaster recovery replication

Where the second and third copies go. Geo-redundant storage on the major clouds replicates to a paired region by design, and failover exists precisely so a workload can run somewhere other than where you put it. Microsoft documents that Azure geo-redundant storage can automatically replicate data to a paired region, that "almost all regions reside within the same geography as their pair", and that Brazil South is an exception, paired with South Central US. Almost all is not all, and the exceptions are the ones that matter to a reviewer. Zone-redundant configurations that keep copies inside a single region usually have to be requested. Failover deserves its own question. An incident moves the live workload into the secondary region, and unless someone owns the decision to fail back, the system runs there for weeks while the residency documentation still describes the primary.

Logs, telemetry and diagnostics

The records a system writes about itself are data too, and the logs, metrics and crash reports carry far more of the content than most reviews assume. Application logs routinely carry filenames, document titles, search queries, user identifiers and error payloads containing fragments of whatever caused the error, and crash dumps can contain anything that was in memory, which in an AI system means the prompt and the retrieved passages. The problem is architectural rather than careless, since observability platforms are centralized on purpose and a vendor operating across regions usually ships logs to one destination in its home region. Ask what leaves, on what schedule, and whether it can be scoped without losing the support you pay for.

What is different when the workload is AI

Everything above applies to any system. AI adds four paths that ordinary application reviews miss, and each can move content across a border while the storage region on the invoice stays where you chose it.

Prompts travel to wherever generation happens, which is what catches otherwise careful architectures. A retrieval layer hosted inside your own network, searching your own index, is genuinely local. If the generation step then calls a hosted model API, every passage the retriever selected is packed into the prompt and sent there. Retrieval-augmented generation deliberately puts your most relevant confidential material into the request body, so a diagram showing a local vector database and a local retriever can be completely accurate and still describe a system that exports your corpus one query at a time.

Embeddings are a derived copy of the corpus rather than a safe abstraction of it. An embedding is a lossy numerical representation of a passage, and people take lossy to mean the original text cannot be got back out, which within a specific range of lengths the research contradicts. Vec2Text recovers 92% of 32-token inputs exactly from their embeddings, and when the authors pointed it at clinical notes from MIMIC-III it recovered 94% of first names, 95% of last names and 26% of the notes verbatim. Names come back far more reliably than documents do, which is the result a privacy officer should take away.

Two limits matter as much as the headline, and vendors quoting the 92% figure usually omit both. The attack requires black-box query access to the same embedding model, one query per refinement step, so a stolen vector store on its own is not what was demonstrated. And accuracy falls with length. Against OpenAI's ada-002 the same method recovers 60.9% of roughly 32-token passages exactly and 8.0% of passages averaging 81 tokens, and the authors state they "have not investigated the limits of inversion beyond embeddings of this length", which is shorter than most production RAG chunks. Later work found product quantization suppresses reconstruction almost entirely without measurable retrieval loss. None of that changes where the index belongs. Treat the vector index as a copy of the material it was built from and give it the same residency and access controls as the originals, including its backups. If your documents cannot leave the country, neither can their embeddings, and neither can the service that generates them.

Fine-tuning sends your training data across the border once and then leaves it there. Sending a training set to a hosted tuning service is a bulk transfer of exactly the material you were protecting, and the exposure does not end when the job does. The dataset sits in the provider's storage, the checkpoints sit beside it, and the resulting weights carry information derived from that data into wherever those weights are later served.

Caches keep copies of content in places the primary store never touches, and they get missed because nobody thinks of a cache as storage. Semantic caches keep prompts and responses so repeated questions are cheap, and hosted providers commonly retain prompts and outputs for a period for abuse monitoring unless a zero-retention arrangement is agreed in writing. That retention lives on the provider's infrastructure under the provider's regional choices rather than yours, and it is usually described on a trust centre page rather than in the contract.

The legal half, which geography cannot answer

The CLOUD Act reaches the provider, not the server

The Clarifying Lawful Overseas Use of Data Act, enacted in the United States in March 2018, settled a question that had been litigated for years. Its operative provision is one sentence. 18 U.S.C. § 2713 requires a provider of electronic communication service or remote computing service to "preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States." Server location is not the operative fact. Control is.

This is measurable rather than theoretical, because the large providers publish the numbers. Microsoft's own law enforcement requests report records 190 requests worldwide for accounts associated with enterprise customers in the second half of 2025. Ninety-four produced a compelled disclosure and 45 of those involved customer content. Microsoft states that in that period it "provided content data to U.S. law enforcement related to 3 non-U.S. enterprise customers whose data was stored outside the U.S.", one of them in the EU or EFTA. Three cases in six months is a small number, and the same report records that 51% of enterprise requests were rejected, withdrawn, unanswerable or redirected to the customer, so this is a provider that pushes back. Three is still three, and it is the exact scenario a residency guarantee is assumed to prevent.

Two consequences follow for a European or Canadian buyer. Corporate nationality belongs in the residency analysis alongside geography, because a US-headquartered provider carries US legal exposure into every region it operates in. A European subsidiary does not automatically break the chain either, since control can run through a parent's ability to direct its own group.

The statute does give a provider a way to resist a demand that would force it to break another country's law. Under 18 U.S.C. § 2703(h) a provider may move to quash where it reasonably believes the customer "is not a United States person and does not reside in the United States" and disclosure "would create a material risk that the provider would violate the laws of a qualifying foreign government", with the motion due within 14 days of service. The Act also created a framework for executive agreements between governments under 18 U.S.C. § 2523. Both routes are narrower in practice than they sound. The Justice Department's own CLOUD Act resources page lists concluded agreements with the United Kingdom, signed in October 2019, and Australia, signed in December 2021, with Canada and the European Union still shown as negotiations rather than agreements.

Keep proportion, though. The United Kingdom's Investigatory Powers Act 2016 lets the Secretary of State serve a technical capability notice on a telecommunications operator, and section 253(8) states plainly that such a notice "may be given to persons outside the United Kingdom (and may require things to be done, or not to be done, outside the United Kingdom)". American providers are not uniquely exposed. Legal reach follows the entity that can technically access the data, which makes the structural answer an architecture where no such entity exists outside your jurisdiction.

Transfer mechanisms and what they require of you

Under Article 44 of the GDPR, moving personal data outside the EEA is a restricted transfer needing its own legal basis on top of the basis you already have for the processing. An adequacy decision by the European Commission under Article 45 covers destinations judged to provide essentially equivalent protection, and Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 covers US organisations on the Data Privacy Framework List maintained by the US Department of Commerce. Standard contractual clauses under Article 46(2)(c) are the general-purpose route for everything else. Binding corporate rules under Article 47 serve transfers inside a corporate group. Article 49 derogations require, among other things, that the transfer "is not repetitive" and "concerns only a limited number of data subjects", which rules them out as cover for a systematic production data flow, and that is how they are sometimes misused.

The stakes are set out in the same regulation. Article 83(5) puts infringements of the transfer rules in Articles 44 to 49 in the top penalty tier, at up to 20,000,000 EUR or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. That tier has been reached. In May 2023 the Irish Data Protection Commission fined Meta Platforms Ireland 1.2 billion euro for infringing Article 46(1) by continuing EU-to-US transfers after Schrems II, and ordered the transfers suspended within five months.

Standard contractual clauses come with homework that buyers often overlook, because signing them obliges you to check whether the destination country actually delivers the protection the clauses promise. In Case C-311/18, decided on 16 July 2020 and known as Schrems II, the Court of Justice declared the Privacy Shield adequacy decision invalid while holding that the standard contractual clauses decision remains valid, precisely because that decision "imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned". Practitioners call the resulting document a transfer impact assessment. The EDPB set out how to produce one in Recommendations 01/2020, adopted in final form on 18 June 2021, as a six-step roadmap running from knowing your transfers through assessing the transfer tool, adopting supplementary measures and re-evaluating at intervals.

The EDPB is specific about which extra safeguards actually count, and encryption qualifies only under the conditions it lists, including that "the keys are retained solely under the control of the data exporter, or by an entity trusted by the exporter in the EEA or under a jurisdiction offering an essentially equivalent level of protection". Where the importer needs the data in the clear to do its job and the destination country's public-authority access powers exceed what is necessary and proportionate, the EDPB states that it is "incapable of envisioning an effective technical measure to prevent that access from infringing on the data subject's fundamental rights". That sentence is the one to read twice, because it means no contractual or cryptographic construction rescues a hosted processing arrangement in that situation.

Canadian buyers face a different shape of the same problem, because the rule that binds them depends on which province they answer to and the provinces disagree with each other. Nova Scotia's Personal Information International Disclosure Protection Act requires at section 5 that a public body ensure personal information "is stored only in Canada and accessed only in Canada", subject to consent, permitted disclosure, or the head of the public body allowing otherwise. British Columbia moved in the opposite direction and took its residency rule off the books. Its FOIPPA data-residency provisions were repealed by amendments that received royal assent on 25 November 2021, and the province's own briefing says the change removed "restrictions that prevented public bodies from storing information outside of Canada", replacing them with a supplementary assessment where sensitive personal information will be stored outside the country. Quebec sits between the two and attaches a condition rather than a prohibition. Section 17 of its private-sector privacy act requires a privacy impact assessment before personal information is communicated outside the province, weighing sensitivity, purpose, protection measures and "the legal framework applicable in the State in which the information would be communicated", and the communication must then be covered by a written agreement. A Canadian public body in Halifax and a Canadian bank in Montreal will reach different conclusions about the same product, and both will be right.

One planning point matters for any system meant to last more than a few years, which is that the legal ground under a transfer can be taken away by a court. Adequacy decisions get reviewed, and two of them have been struck down, Safe Harbour in 2015 and Privacy Shield in 2020, both by the Court of Justice. The 2023 decision commits the Commission to continuous monitoring and periodic review, with the first review due within a year of entry into force. An architecture whose lawfulness rests entirely on an adequacy finding carries a risk outside your control. Designs that stay lawful under standard contractual clauses with real technical measures, or that avoid the transfer altogether, do not need re-architecting when the legal ground moves. The national sovereign AI programmes now being funded across Europe exist substantially because governments reached that conclusion at national scale.

Controls that fix the problem and controls that document it

The two categories look much the same in a contract and behave very differently under pressure. A control that documents the problem gives you evidence, notice and a basis for recourse after the event has already happened. A control that fixes the problem makes the exposure technically impossible, so there is nothing left to compel or to leak. Both have value, and only the second one survives a determined legal order.

Customer-managed keys deserve a closer look, because they are the control most often presented as a jurisdictional answer and most often misunderstood. In the usual arrangement the key lives in a vault under your control and the provider's service calls that vault to unwrap the data encryption key whenever it needs to read your content. You gain a real kill switch, an audit trail of unwrap calls, and protection against a copy of the storage volume being useful to anyone. What you do not gain is protection during processing, because the service holds delegated authority to decrypt and plaintext exists in its memory every time it serves a request. The EDPB says the same thing in colder language. Where unencrypted personal data is technically necessary for the processor to provide the service, "transport encryption and data-at-rest encryption even taken together, do not constitute a supplementary measure that ensures an essentially equivalent level of protection if the data importer is in possession of the cryptographic keys." If a court orders that provider to produce content it can currently read, key custody does not prevent it. Key custody becomes a jurisdictional control only when the provider cannot access the key material in use, which means it never sees plaintext, which in turn rules out having that provider run inference for you.

Cryptography does not currently get you around that. Inference on encrypted data remains a research area rather than a production pattern. Confidential computing narrows the exposure by keeping plaintext inside a hardware-protected enclave, which is a genuine improvement, and it relocates the trust question rather than removing it, since you are then trusting a silicon vendor's attestation chain. Where the requirement is that no foreign entity can be compelled to produce readable content, the answer is architectural.

Architectures that answer jurisdiction rather than geography

Ordered from the one that answers least to the one that answers most. Read it as a ladder and stop at the first rung that satisfies your actual obligation, because every rung above it transfers work to your team permanently.

Notice where the jurisdictional break falls. The first three rungs answer geography and constrain the provider contractually. Only from the fourth rung onward does the provider stop being an entity that can be compelled to produce your content, because it no longer holds the technical ability to read it.

VIDIZMO's own deployment tiers sit at different rungs of this ladder rather than outside it. On shared SaaS, physical content storage is customer-selected and files can be hosted in any storage region Microsoft Azure supports, while metadata, the database and content processing sit primarily in U.S. East data centres. That answers storage residency and does not answer processing residency, so a European or Canadian buyer whose requirement covers processing, and not only where files rest, should not stop at the shared tier. A dedicated SaaS deployment places the entire deployment in the customer-chosen cloud region, including Canadian data centres or UK South, which closes the processing question while VIDIZMO still operates the environment. Private cloud and on-premises deployments put everything inside the customer's own data centre or cloud region, which is the rung where the jurisdictional question closes too. How that range plays out across storage, hosting, encoding and streaming is covered in deployment flexibility for compliance requirements.

The AI layer follows the same rule, and it follows it for every model class rather than the language model alone. In on-premises and air-gapped deployments the inference layer runs on the customer's hardware instead of a hosted API, so prompts and the passages retrieved into them never leave the environment, and embedding generation, speech-to-text, translation, OCR, object and face detection and entity detection all run locally on the same principle. That distinction is worth pressing any vendor on, because a system that self-hosts the language model and calls a cloud service for transcription has exported the recording in full before the language model saw anything. On the access path described earlier, VIDIZMO staff hold no standing access to customer environments, with break-glass only, time-bound, MFA-enforced and fully logged. VIDIZMO is ISO/IEC 27001:2022 certified under certificate RA-2507091, and as a Virginia-incorporated company it sits inside US jurisdiction, which is precisely why the deployment rung you choose carries the weight in this decision.

Questions to ask a vendor about residency

These are deliberately narrow. A broader set covering training, telemetry, model versioning and exit is in the security questionnaire for AI vendors.

1. Name every component that holds or handles my content and give the region for each separately, covering the primary store, the database, the search and vector indexes, the processing tier, backups and logs.
2. When I select a region, what is actually scoped by that selection, and which services keep their own default region regardless of my choice?
3. Where does generation run for each AI feature, and does the answer change with the feature or the model I select?
4. Which region do backups and disaster recovery replicas land in, and if a failover moves the workload, who decides when it fails back?
5. From which countries can your staff reach a running production system, under what approval, and is that access logged in a record I can obtain?
6. Are prompts, outputs or intermediate artefacts retained anywhere for abuse monitoring, caching or quality review, for how long, and in which region?
7. Which legal entity am I contracting with, where is it incorporated, and which parent or affiliate could direct it to produce my data?
8. Will you provide a data flow map naming every subprocessor and region, and accept it as a contractual annex rather than a marketing document?

The first question is the most revealing, because it asks for the answer component by component. A vendor whose residency story is real can produce that list without a meeting. A vendor whose residency story is a region dropdown will answer with the region dropdown, and you will have learned what you needed to know.