ZetrixwebWhat each market tends to ask
The United States has no general data residency requirement, but sector rules and customer contracts matter: healthcare data brings business associate agreements and security expectations, government work can bring specific authorization requirements, and state privacy laws shape handling. In the European Union, the GDPR does not mandate residency but restricts transfers outside the European Economic Area unless a mechanism such as an adequacy decision or standard contractual clauses applies, and sovereignty expectations, especially from public bodies, are rising. In Singapore, the PDPA expects organizations transferring personal data overseas to ensure it receives comparable protection, and regulated financial institutions apply outsourcing and technology risk expectations to suppliers.
In practice the sharpest requirements come from customer contracts, not statutes.
Decide per data type
Break the question into parts. Prompts and outputs may contain personal or confidential data. Logs and traces may contain both. Embeddings and vector stores can leak information about their source. Encryption keys control access to everything else. Each can be placed differently, and often the keys and the logs matter more to customers than the model call itself.
Check that the model providers you use offer processing in the regions you need, and what retention they apply. Availability of specific models can differ by region.
| Data type | Typical concern | Common design choice |
|---|---|---|
| Prompts and outputs | Personal or confidential content | Process in customer's region where required |
| Logs and traces | Persistent copies of content | Store regionally with short retention |
| Embeddings and vector stores | Derived data can reveal sources | Keep in-region with the source data |
| Encryption keys | Control and access | Region-specific keys under customer or regional control |
A region-aware architecture
Route requests by tenant or user to the correct regional stack. Keep per-region storage, logs, and keys, and a thin model adapter that can point to a regional endpoint. Make residency a configuration of the tenant, not a fork of the code. Keep infrastructure reproducible so adding a region is a repeatable task.
Document the flows so you can answer a customer's questionnaire accurately. Our guides on EU sovereign hosting and on cloud portability cover the European details.
Designing AI features for customers in several regions? Talk to us about a region-aware architecture.
Key takeaways
- No market mandates residency in general, but contracts and sector rules often do; ask your major customers.
- Decide per data type: prompts and outputs, logs, embeddings, and keys.
- Route by tenant to regional stacks with regional storage, logs, and keys.
- Make residency configuration, not code forks, and keep infrastructure reproducible.