Data residency is the physical location where data is stored and processed, such as one country or one cloud region, often fixed by law, contract or internal policy. For AI tools, a residency commitment has to cover the whole data path: prompts, processing, outputs, logs, backups and support access.
Why is data residency harder with AI tools?
Because an AI workflow moves data through more places than a typical application. A file can stay in your cloud account while an excerpt is sent to a model, an answer comes back and a log is saved, each with its own location. Microsoft's documentation, for example, notes that prompts sent to a "Global" Azure OpenAI deployment may be processed in any Azure region, even when stored data stays in the chosen geography.1
For banks and credit unions, the institution stays accountable for customer data even when a vendor handles part of the work. See our guide on how banks can keep customer data in-region and our work with banks and credit unions.
Frequently asked questions
Is data residency the same as data sovereignty?
They overlap. Data residency is about where data is physically stored and processed. Data sovereignty is about which country's laws govern that data, which can depend on where the provider is based as well as where the servers are. Regulated businesses usually need to consider both.
Sources
