"Where does the data live?" sounds like one question. For a US MSP carrying regulated clients it is at least four, and they ask for different evidence.
The reason this matters commercially is that the answers arrive at different speeds. One of them is on a web page. The rest require somebody to write something down and sign it, which is why they tend to surface late in a procurement and stall it.
What each regime actually asks
The table below is the practical version — what a vendor has to produce, rather than what the statute says.
| Regime | What it asks for | Answerable from a web page? |
|---|---|---|
| HIPAA | A Business Associate Agreement, and where PHI physically rests | ✗ no |
| GLBA | Safeguards over customer financial data, including sub-processors | ✗ no |
| State privacy acts | Disclosure of processing location and onward transfers | ✗ no |
| FRCP 37(e) | That the data can still be produced | ✓ yes |
Storage residency is the easy layer
Where the bytes sit is the layer everyone markets, and it is the easiest to demonstrate. It is also the least interesting on its own, because encrypted data is mathematically inaccessible without the key.
The follow-up question is where the keys live, and the one after that is who can decide to use them. A vendor that answers the first confidently and hesitates on the other two has told you something useful about how far the residency claim reaches.
For this platform the answer to the first is plain: US compute and US storage, end to end. Not "primarily", not "with some processing elsewhere". MSPs who want to remove the question entirely can bring their own storage bucket and hold their own keys, which moves both the data and the control into their own account.
Three of the four rows above cannot be closed from a website — including ours. Asking at proposal stage rather than at contract stage is the difference between a clarification and a delay.
Why this got harder rather than easier
For most of the last decade residency was a procurement preference with modest operational consequence. Two things changed that. State privacy legislation multiplied, so a single MSP now serves clients under several regimes at once rather than one. And cyber-insurance underwriting stopped accepting attestation as sufficient — insurers increasingly want to know which party would be subject to compulsion, and price accordingly.
The practical effect is that a residency answer now has to survive being read by somebody adversarial. Marketing language does not survive that; a contract and a sub-processor list do.