Data Residency
Definition
Data residency is the answer to a simple question with complicated consequences: in which country is this stored? Three neighbouring terms get muddled with it. Residency is the chosen location; data sovereignty is the idea that data is subject to the laws of the place it sits; data localisation is a legal requirement to keep certain data inside a border, which some countries impose on health, financial or government records. For a hosting account, residency usually means the region of the storage bucket that holds your uploads — eu-west-1 in Ireland, or a Frankfurt region, or somewhere in the United States — chosen when the account or project is created and rarely changeable afterwards. A point people miss: content distribution copies files to cache nodes worldwide, and those transient copies are a different matter from the authoritative store, which is why a residency commitment is normally written about the origin and the backups.
Why It Matters
Residency shows up in procurement long before it shows up in law. Public sector buyers, hospitals, schools and plenty of European companies have a policy sheet that asks where data is held, and an answer of anywhere is enough to end the conversation. Under the GDPR, moving personal data outside the EU is permitted but conditional: an adequacy decision covering the destination, or standard contractual clauses plus an assessment of the local legal regime. Getting this wrong is not usually dramatic — it is a contract that stalls, a security questionnaire that comes back with a red row, an enterprise deal that goes elsewhere. This is general information rather than legal advice, but the practical lesson is to know your answer before someone asks for it in writing.
How It Works
In storage terms a region is a group of data centres in one geography, and an object written there stays there unless something explicitly copies it. Backups and replicas deserve their own answer, because a cross-region replica is a second residency that people forget they turned on. Encryption keys have a location too, and a provider that keeps ciphertext in Frankfurt while managing keys elsewhere has a story to tell about both. Edge caching muddies the water: a file served through a CDN is copied to nodes near visitors for the length of its Cache-Control lifetime, and those copies are short-lived and derivative rather than the record of truth. When a commitment is genuinely needed, it belongs in the contract in writing, naming the regions for storage, backup and processing, not inferred from a marketing page.
Real-World Example
A council department wants to publish a consultation document and its supporting spreadsheets, and the procurement form asks where uploads are stored and whether they leave the UK or EU. The material at consultation-2026.99helpers.site is public by design — nobody is troubled by it reaching a cache in Sydney — so the question that actually matters is where the account record and the form submissions live, not the PDF. Answering that precisely, and keeping the responses out of the file store entirely, moves the form along. The awkward version of this conversation is the one that starts after publication.
Common Mistakes
- ✕Confusing an edge cache with storage — a cached copy near a visitor is not where the authoritative file lives, and conflating the two makes the answer sound worse than it is
- ✕Answering for the main store but forgetting backups, replicas and the support system where files get attached to tickets
- ✕Assuming a European company name means European storage — the region is a setting, and it usually defaults to somewhere in the United States
Related Terms
GDPR
The European Union's General Data Protection Regulation, in force since 25 May 2018, governing how personal data about people in the EU may be collected and used. The UK keeps a near-identical version in its own law.
Personal Data
Any information relating to a person who can be identified, directly or indirectly. The definition is broader than most people expect — an IP address counts, and so does an identifier that only becomes a name when combined with something else.
Encryption at Rest
Storing files in encrypted form, so the bytes on disk are meaningless without the key. It protects data that is sitting still — on a drive, in a backup, on hardware being retired.
Object Storage
Object storage keeps each file as a self-contained object — its bytes, its metadata and a key that names it — inside a flat container reached over HTTP. There is no directory tree and no file handle to open, seek and write.
CDN
A content delivery network: a set of servers spread across the world that keep copies of your files and answer each visitor from somewhere close to them. It is the service; the machines it runs on are its edge network.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →