Evidence note · reviewed 29 July 2026
“Where is the data?” is not one question.
Residency describes location. Control also depends on tenancy, administrators, keys, support paths, logs, backups and the ability to exit.
The nine-part custody map
Storagedocuments, indexes, caches
Processinginference and temporary data
Tenancyshared or dedicated resources
Controlmanagement plane location
Keysownership and access
Peopleadministrators and support
Logscontents and retention
Copiesbackup and recovery
Exitexport, return and deletion
A credible deployment record answers every cell and names unresolved exceptions.
Decision rule
Choose the least permissive boundary that still supports the intended work. Record every cross-boundary flow and its owner. If a supplier cannot explain a support or recovery path, treat that path as unknown rather than local.
Evidence boundary: this is an architecture method, not proof that a specific hosting or on-premises environment meets it.