"Where does the data live?" sounds like one question. For a US MSP carrying regulated clients it is at least four, and they ask for different evidence.
The reason this matters commercially is that the answers arrive at different speeds. One of them is on a web page. The rest require somebody to write something down and sign it, which is why they tend to surface late in a procurement and stall it.
What each regime actually asks
The table below is the practical version — what a vendor has to produce, rather than what the statute says.
| Regime | What it asks for | Answerable from a web page? |
|---|---|---|
| HIPAA | A Business Associate Agreement, and where PHI physically rests | ✗ no |
| GLBA | Safeguards over customer financial data, including sub-processors | ✗ no |
| State privacy acts | Disclosure of processing location and onward transfers | ✗ no |
| FRCP 37(e) | That the data can still be produced | ✓ yes |
Storage residency is the easy layer
Where the bytes sit is the layer everyone markets, and it is the easiest to demonstrate. It is also the least interesting on its own, because encrypted data is mathematically inaccessible without the key.
The follow-up question is where the keys live, and the one after that is who can decide to use them. A vendor that answers the first confidently and hesitates on the other two has told you something useful about how far the residency claim reaches.
For this platform the answer to the first depends on the bucket: backups are written to an S3-compatible bucket that is either your own, in the region you choose, or, for direct customers, a bucket we provide, whose location we tell you on request. The platform itself is operated by Synchplus Consulting (Pty) Ltd, a South African company, so account and operational data, Microsoft Entra ID records and any eDiscovery search index may be processed in South Africa, as our Privacy Policy sets out. Bringing your own bucket moves the backup data, and the storage contract, into your own account; the encryption keys stay with us, wrapped under our platform key.
Three of the four rows above cannot be closed from a website — including ours. Asking at proposal stage rather than at contract stage is the difference between a clarification and a delay.
Why this got harder rather than easier
For most of the last decade residency was a procurement preference with modest operational consequence. Two things changed that. State privacy legislation multiplied, so a single MSP now serves clients under several regimes at once rather than one. And cyber-insurance underwriting stopped accepting attestation as sufficient — insurers increasingly want to know which party would be subject to compulsion, and price accordingly.
The practical effect is that a residency answer now has to survive being read by somebody adversarial. Marketing language does not survive that; a contract and a sub-processor list do.