What is data residency?
Data residency is the country or region where data is physically stored and processed. It matters because laws such as the GDPR and some sector rules restrict where certain data may live. A related term, data sovereignty, is about which country's laws apply to that data.
What the buyer is really asking
This is usually a data residency question in disguise. The buyer needs the region or country where their data is stored, and sometimes the provider, to meet their own legal obligations.
Other ways buyers ask it
Every one of these wants the same answer:
- “Where is customer data stored?”
- “In which regions is our data hosted?”
- “Does our data leave the United States (or EU)?”
- “Where do you store sensitive or regulated data?”
Evidence to have ready
- The hosting provider and regions in use
- A subprocessor list with locations
- Any residency commitments in your terms
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.
Related data protection questions
- Which groups of personnel (employees and contractors) have access to personal and sensitive data?
- How do you mask, anonymize, or tokenize sensitive data in non-production environments?
- Describe your data encryption at rest strategy.
- What protocols and standards are used for data in transit encryption (e.g., TLS 1.2+)?