Where is your business data stored? Questions to ask vendors

Data residency is where your data is physically stored and processed. To find out, ask any software vendor where the main database, the backups, uploaded files and logs are kept, who can access them and from where, and which third parties process your data on the vendor's behalf.

The question sounds technical, but it matters to small businesses too. Customers ask about it in procurement forms, some sectors have rules about it, and the answer affects which laws can reach your records. Vendors rarely volunteer the full picture, so it pays to ask precise questions and get the answers in writing.

Residency, sovereignty and localization

Term	What it means	Who decides
Data residency	The country or region where data is stored and processed	Usually the vendor, sometimes you, by choosing a region
Data sovereignty	Which country's laws apply to the data and who can demand access	The law of each place the data and the vendor sit in
Data localization	A legal rule that certain data must stay inside a country	A government or regulator

The three overlap but are not the same. Data stored in one country by a company based in another can fall under both countries' laws, which is why the vendor's own location belongs on your question list too.

Does the GDPR require data to stay in the EU?

No. Under the GDPR, personal data can generally leave the European Economic Area when a safeguard is in place, such as an adequacy decision or Standard Contractual Clauses. Those safeguards are often paired with a transfer impact assessment.

Many businesses still prefer storage inside the EU because it keeps those questions simple. That is a preference, not a legal requirement, and either way you need to know where the data actually goes. Our checklist of GDPR questions to ask before you put customer data in a business app covers the wider picture.

The questions to ask any software vendor

Storage

• In which country or region is the main database stored?
• Where are backups kept, and for how long? Backups often sit somewhere other than the live data.
• Where are uploaded files and attachments stored?
• Where do logs and analytics data go, and do they contain personal data?
• Can I choose the region, and will you tell me before it changes?

Access

• From which countries can your support and engineering staff access my data?
• Is that access logged, and can I see the log?
• Is data encrypted in transit and at rest, and who holds the keys?

Third parties

• Do you publish a subprocessor list, with what each one does and where?
• How much notice do you give before adding a subprocessor?
• Which services send email, process payments or run AI features, and where do they process data?

AI features deserve a question of their own: a prompt can carry customer names, amounts and notes to a model provider in another region. Our guide to what business data an AI assistant sends to the provider explains what to look for.

Transfers and contracts

• Which transfer mechanism covers data leaving the EEA, if any does?
• Will you sign a data processing agreement, and does it name the locations?
• What happens if a government asks you for my data?

Leaving

• In which formats can I export all my data, and how long does it take?
• When I leave, how soon is my data deleted, backups included?

Exit questions are easy to skip and expensive to discover late. Our guide to data portability questions to ask any business software vendor goes through them one by one.

When the location matters most

• Your customers ask. Larger customers often send a security questionnaire that asks where their data will be stored. You can answer for your own tools once your vendors have answered you.
• Your sector has rules. Health, finance, legal and public-sector work can come with requirements about where records may be kept.
• You hold sensitive records. Contracts, payroll and personal details raise the stakes of a transfer you did not know about.
• You plan to grow abroad. A location that suits one market may need a second look in another.

How to read the answers

• Specific beats reassuring. A named city or cloud region for the database, and another for the backups, is an answer. "Your data is secure in the cloud" is not.
• Written beats spoken. Ask for the location in the contract, the data processing agreement or a published page, not just on a sales call.
• Complete beats partial. If the answer covers the database but not backups, files, logs or subprocessors, ask again.
• Change notice matters. A location that can move without notice is a location you don't really know.

Frequently asked questions

What is data residency in SaaS?

It is the physical location where a cloud service stores and processes your data. For a software subscription, that usually means the vendor's chosen data center region, plus wherever its backups and third-party services run.

What questions should I ask a SaaS vendor about data location?

Ask where the main database, backups, uploaded files and logs are stored, and from which countries staff can access them. Ask for the subprocessor list and the transfer mechanism for any data leaving the EEA. Get the answers in writing, ideally in the data processing agreement.

Is data residency the same as data sovereignty?

No. Residency is where the data is. Sovereignty is whose laws apply to it, which can include the laws of the country where the vendor is based, not just where the servers are.

Where are backups usually stored?

It varies. Many vendors keep backups in a second location for resilience, sometimes in another country. Ask for the backup location and the retention period separately from the main database.