Often somewhere other than the region on the pricing page. Backups, replicas, failover sites and logs can live in different places from your primary data. Ask the vendor for a full list of countries and regions for every copy, and require notice before any of them changes.
Primary region is the easy part
When a vendor says "your data is hosted in Frankfurt," that usually describes the main database. The same data may also sit in:
- backup storage, perhaps in another region
- a disaster recovery site
- search indexes and caches
- logs and support exports
- analytics or machine learning stores built from your data
NCSC's cloud security guidance names this directly. It tells customers to know where data is stored, processed and managed, to get a complete list of countries from the provider, and to require contractual notice of changes. It lists derivatives such as verbose logs and machine learning models in the data to account for. It also says to understand how resilience measures, such as failover across sites, affect where data resides.
A table to send the vendor
| Copy | Questions |
|---|---|
| Primary store | Region, country, who operates the facility |
| Backups | Region, retention, encryption, who can restore |
| Disaster recovery | Failover region, whether it is automatic, whether it leaves the country |
| Logs and metrics | Where stored, whether they contain customer data |
| Support tooling | Do exports or tickets copy data elsewhere |
| Subprocessors | Which ones touch which copy |
If you handle personal data under GDPR, Article 28 requires the processor contract to cover processing on documented instructions, including transfers to third countries, and to address sub-processors, deletion or return of data and audits. Your legal team should read the processor terms against your answers. This is not legal advice.
What a good answer looks like
A strong response names regions for each copy, states what happens in a failover, and commits to notice before changes. A weak response repeats "our data centers are in the EU" without addressing backups or logs.
Failover and residency can conflict
Resilience pushes data across sites. Residency pushes it to stay in one. Both are legitimate. The vendor should tell you which it favors and let you choose where it matters. If a failover region is outside your allowed area, ask whether it can be disabled, and what that does to the recovery commitment.
Clauses to request
- A written list of countries and regions for every copy of customer data.
- Notice, for a stated period, before any change, with a right to object or exit.
- Confirmation that backups stay within the stated area unless you agree.
- Deletion of all copies, including backups, within a stated period after termination.
See also our guides on data residency questions in questionnaires and where EU data leaks out of region.
Quick check
Is the primary region the only location that matters?
No. Backups, failover sites, logs and support tools can sit elsewhere. Ask about each.
Should I ask for a list of countries?
Yes. NCSC advises getting a complete list from the provider and requiring notice of changes.
Safeguard helps with compliance and evidence automation so your own answers about data location stay documented.
Sources
Last reviewed: 19 October 2026.
