What data residency actually means
Data residency means choosing the country or region where your data is stored. If your files sit on servers in Frankfurt, your residency is in the EU. If they sit in Virginia, it is in the US.
Key takeaways
- Data residency is the country or region where your files are physically stored. It is a setting you can ask for, not a vague promise.
- Residency is not the same as sovereignty. Where data sits and which laws can reach it are two separate questions, and a good vendor answers both.
- Pick the region from your customers and your contracts, not from habit. Then ask what else leaves that region, such as backups, logs and support access.
It sounds like a technical detail. For many companies it is a contract term. A customer in Germany may ask that their documents stay in the EU. A public body may require it. A security questionnaire from a large buyer will almost certainly have a line about it.
What counts as "your data"
Files are the obvious part. But the same question applies to the database behind your apps, backups, search indexes, logs and any copies made for processing. A vendor can store your files in one region and still keep a copy of something else in another. That is why the questions further down matter.
Residency, sovereignty and localization are not the same
These three terms get mixed up constantly. Keep them apart and most vendor conversations get easier.
- Data residency: where the data is stored. A choice of location.
- Data sovereignty: whose laws apply to the data. A vendor headquartered in one country can be subject to that country's rules even when the servers are in another.
- Data localization: a legal rule that data must stay inside a country. It is a requirement, where residency is a setting.
Residency is the part you can control directly, so it is the right place to start. Just do not assume it answers the sovereignty question. If a regulator or customer asks about both, you need to be able to say what you know about each.
Why companies care about it
There are four common reasons, and most companies have at least one.
- Regulation. GDPR limits how personal data of people in the EU can move outside it. Some sectors and some countries add their own rules on top.
- Contracts. Customers put storage location into agreements and security reviews. If you cannot answer, the deal slows down.
- Speed. Files stored closer to your people open faster. For a team in Amsterdam, a server in Europe is simply quicker than one on another continent.
- Trust. Staff and customers feel better when you can say plainly where their information is. "Somewhere in the cloud" is not an answer.
None of this is a reason to panic. It is a reason to know the answer before somebody asks.
Questions to ask a vendor
A feature list that says "global data centers" tells you very little. Ask these instead.
- Can we choose the region ourselves? Or is it decided for us when we sign up?
- Which regions are available? Name them. US, EU and Asia are common choices.
- What stays in the region? Files, yes. But also backups, metadata, search indexes and logs?
- Who can access the data, and from where? Support staff working in another country can be a form of access.
- Can we move later? Business changes. A region you picked in year one may not fit in year three.
- Is our data used to train AI models? It is a separate question from residency, but buyers now ask both in the same breath.
Write the answers down. You will be asked the same questions again by your own customers.
Choosing a region without overthinking it
Start with three facts about your own company.
Where are your customers and contracts?
If most of your customers are in the EU and you handle their personal data, the EU is the safe default. If your contracts name a country or region, follow the contract. If you serve mostly the US market, a US region is usually the simplest.
Where are your people?
Pick a region near the people who open files all day. It will not change the legal picture, but it will change how fast a large file loads.
What does your security review expect?
Look at the last questionnaire a customer sent you. Whatever it asked for is your minimum. If you have no questionnaires yet, assume the first big customer will send one, and choose a region you can defend.
Then write one paragraph in your internal docs: which region, why, and who approved it. It takes ten minutes and saves hours later. For the wider picture of keeping files safe, including access control and sharing outside the company, read our guide to secure file sharing for business.
Where WeldDrive fits
WeldDrive is the file storage layer in WeldSuite, and it is where data residency is set. You can choose to store your data in the US, the EU or Asia. Files created in other WeldSuite apps land in WeldDrive automatically, so a quote from WeldCRM or an attachment on a WeldDesk ticket follows the same storage choice as everything else. Access controls decide who can open a file, files can be set to expire, and WeldAgent can search across them. WeldSuite does not train AI models on your data.
If you are setting up storage for a whole company, our overview of a document management system covers how to organise it, and document version control covers keeping one current copy of every file.
WeldDrive is one of twelve apps included in every WeldSuite tier. WeldSuite is a complete software suite for mid-market and enterprise teams, priced per user per month. Data residency, SSO, SAML, a dedicated customer success manager and a 99.999% uptime SLA come with the Enterprise tier, which you can ask about by booking a demo.
Sources
- Wikipedia: Data localization https://en.wikipedia.org/wiki/Data_localization
- Wikipedia: General Data Protection Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
Frequently asked questions
What is data residency?
It is the country or region where your data is physically stored. Choosing data residency means deciding, for example, that your files stay on servers in the EU.
What is the difference between data residency and data sovereignty?
Residency is where the data sits. Sovereignty is which country's laws can apply to it. A vendor can store your data in one region and still be bound by the laws of the country where it is headquartered, so ask about both.
Does GDPR require data to stay in the EU?
Not in every case. GDPR sets rules for moving personal data of people in the EU outside the EU, and those rules need a legal basis. Keeping the data in the EU is the simplest way to stay clear of the question. For your own situation, check with a legal adviser.
Can I change my data region later?
That depends on the vendor. Ask before you sign whether a move is possible, how it works and whether it costs extra. Do not assume it is a one-click setting.
Do backups and logs count?
They should. Ask a vendor where backups, search indexes and logs are stored, not only the files. A region promise that covers only part of your data is only a partial answer.
See it all work together
WeldSuite brings CRM, helpdesk, accounting, mail, projects and more into one connected platform. Change something once and it shows up everywhere.
Keep reading
Secure File Sharing for Business: What to Look For and How to Set It Up
Secure file sharing is about who can open a file, what they can do with it, and whether you can prove that later. Here is what actually reduces risk and how to move your team over to it.
CollaborationWhat Is a Document Management System? A Guide for Growing Teams
A document management system gives your team one place to store, find, and control access to company files. Here is what it is, what it manages, and how to choose the right one.
CollaborationDocument Version Control: How to Stop Working on the Wrong File
Most version problems are not technical. Two people edit two copies, and nobody knows which one counts. Here is how version control for documents works and how to set it up without a big process.