A customer asked us, reasonably, to describe every country in which their data is processed. I expected the answer to take a day, because our contracts specify storage in our own region and I had checked that personally when we signed them.
The contracts were accurate. Data at rest stayed where it was promised. Everything else moved.
Diagnostic telemetry from the platform, which includes record identifiers and whatever free text appears in an error message, went to the supplier's global logging estate. Backups replicated to a paired region in a neighbouring jurisdiction, which is a documented default on that service and one we had accepted at provisioning without noticing. Support operates around the clock from three countries, which is the entire reason it can answer at three in the morning, and any file we attach to a ticket is readable by whoever picks it up. A recently enabled assistant feature processed its requests somewhere else again, and had been switched on by the supplier as part of a release. A sub-processor handled outbound email.
None of this was concealed. Every item was described in documentation we had accepted, in the pages nobody reads after the commercial terms are agreed.
What I took from it is that residency is a property of flows rather than a property of storage, and the storage is the easy half. Data leaves a region for operational reasons, continuously, in small quantities, for logging, for support, for analytics and now for features that did not exist when the contract was signed.
We produce a processing map for each significant service now. One page: where it runs, where backups go, where telemetry goes, who can read a support ticket, which sub-processors exist, and what happens when the supplier enables something new. It is refreshed annually and at every renewal, and it is the document we hand a customer rather than the contract clause.
Where it mattered, we bought commitments on backup region and on support access location. One supplier charged for it, one refused outright, and the refusal was the most useful thing we learned that quarter.
We had bought a promise about where data sits. We were being asked a question about where it goes.
– Serguey Shinder
