Glossary
Data residency
Also called: data sovereignty, regional hosting
Data residency is the commitment that data is stored and processed within a specified country or region. In a document system it usually applies to document bytes, and the exception worth asking about is whether metadata, search indexes and audit records follow them.
Data residency explained
The exception to ask about
A vendor states that documents are stored in your region. The question that follows is whether the search index, the metadata database, the audit trail and any AI processing are also in that region — because frequently they are not, and the residency claim is qualified in a way nobody mentioned.
That matters practically as well as legally: a search index contains document text, which is the content the residency requirement was about.
Residency versus sovereignty
Residency is about where data physically sits. Sovereignty is about which jurisdiction's authorities can compel access to it, which can differ — data held in-region by a company subject to another country's disclosure laws may satisfy residency and fail sovereignty. If the concern is lawful access rather than location, ask about corporate structure rather than data centres.
Customer-provided storage
Pointing a document system at your own cloud storage account changes the nature of the commitment. The bytes sit in a bucket you control, in a region you chose, under your keys and your access logging — which converts a vendor assurance into something you can verify yourself.
It does not move the metadata or the index, which is why the first question on this page still applies.
FAQ
Data residency: common questions
Is residency the same as encryption?
No, and they solve different problems. Encryption protects data from unauthorised access; residency constrains where it sits and which authorities can reach it. Most regulated buyers need both.
Does using our own storage account make us self-hosted?
No. The application still runs as a managed service. It addresses residency and key custody, not deployment — a distinction worth being precise about with an auditor.
Related terms
- Access reviewAn access review is a periodic check that the people who have access to something still need it.
- API keyAn API key authenticates a program rather than a person.
- Break-glass accessBreak-glass access is a deliberate, time-boxed grant of permissions a user does not normally hold, for genuine emergencies.
- Encryption at restEncryption at rest protects stored data by encrypting it on disk, so that physical access to the storage medium does not yield readable content.
- Permission inheritancePermission inheritance means a document takes its access rights from the folder containing it, rather than being permissioned individually.
- Role-based access controlRole-based access control grants permissions to roles rather than to individuals, and assigns people to roles.
آخر مراجعة: 28 أغسطس 2026. Browse the full glossary.