Skip to content

Multi-region and data residency

Where a tenant's writes land is a latency choice; where its copies live is a legal one.

Predict first

Before you read: predict

A video-streaming service signs a German broadcaster whose contract says its viewers' personal data must stay in the EU. The team moves the database primary to eu-central-1 (Frankfurt) and changes nothing else. The other stores are: a read replica in us-east-1 that copies every database row; nightly database backups copied to us-east-1; application logs, one line per API call with the caller's account id, shipped to a log service in us-east-1; an error tracker in us-east-1 whose crash reports carry the signed-in viewer's email; a worldwide CDN caching video segments, the same bytes for every viewer; and a title search index in eu-central-1.

How many of these other stores still hold the broadcaster's viewers' data outside the EU?

Pick one

The 30-second version

Distance puts a floor under every cross-region round trip, so where each tenant's writes land and where its reads are answered are design choices. Writing in every region costs a round trip per write, or loses writes that do not merge. Residency is a separate, legal constraint on where personal data sits: every copy counts, not only the database.

Where a tenant's writes land is a latency choice; where its copies live is a legal one.

How it works

Step 1 of 13

The floor: a round trip between regions costs at least the fibre floor (the prerequisite): Frankfurt–Dublin about 11 ms, Frankfurt–Ashburn about 65 ms.

Analogy: An international auction house's salerooms

The house sells in London and New York.

In the salerooms In a system
each lot belongs to one saleroom, whose clerk alone records its bids one home write region (step 3)
the catalogue goes to every city; any saleroom answers questions from its copy local reads (step 4)
two clerks taking bids on one lot at once would each sell it active-active writes colliding (step 6)
a consignor's contract may forbid a lot leaving the country, whatever the export rules allow a contract stricter than the transfer rules (steps 9, 11)
the buyer files and condition reports are papers about the lot too every copy counts (step 10)
each saleroom has its own vault, staff and records a stamp (step 12)

Breaks down when: two clerks can phone each other and agree who sold the lot; copies only follow their merge rule (step 6).

Contrasting case: a country auctioneer with one saleroom: every bid is local and no lot crosses a border, so none of this arises.

In real terms: for each tenant, name the region that takes its writes, where each copy of its data lives, and which rule allows it there.

Examples, run for real

4.1 ExamHall EXH-4280: the ministry's answers after the move

A ministry tenant required that its candidates' data stay in the EU. ExamHall moved the ministry's database primary to eu-central-1; the proctoring-video bucket still replicated to us-east-1, backups went to us-east-1, and crash reports to an error tracker there. The exam paper is served worldwide from a CDN.

4.1 before: stores outside the EU holding candidates' ids or emails 3 (video bucket copy, backups, error tracker) · the CDN holds none: it caches only the paper
4.1 MR !4580: stores outside the EU holding candidates' data 0 · the CDN still serves the paper worldwide

The bucket copy, the backups and the crash reports each still held candidates' data (steps 9–10); the CDN held only the paper, the same for everyone. MR !4580 moves the bucket copy and backups to eu-west-1 and the error tracker to eu-central-1.

4.2 Where an autosave is confirmed

ExamHall homes each university in one region. A Frankfurt-homed university's candidates autosave from Frankfurt, from Dublin and from Ashburn; each save takes 2 ms of work.

4.2 autosave confirmed in Frankfurt (home): from Frankfurt p99 2 ms · from Dublin 13 ms (floor 10.9 ms) · from Ashburn 67 ms (floor 65.5 ms)

The save goes home wherever the candidate sits, so it pays the floor to Frankfurt (steps 1, 3–4); reading the paper stays local.

Try it

Answer first, then check. Nothing is saved.

Question 1 of 6

A ticketing platform serves companies from eu-central-1 and us-east-1, a 65 ms round trip apart at the fibre floor. Each company's order gets a ticket added about once a second, and 1 save in 10 comes from a colleague in the other region; a save reads the order, adds one ticket and writes it back, with 2 ms of work. Copies between regions arrive 1 s after a save. The team needs a save made in the company's own region confirmed within 20 ms at p99, no added ticket ever silently dropped, and at most the last 2 s of saves lost if a region is lost.

Which design meets all three?

Pick one

Question 2 of 6

A Berlin chat start-up keeps EU users' messages in eu-central-1. It wants to send users' names and emails to a US support-desk vendor that is certified under the EU-US Data Privacy Framework; no customer contract limits where data goes. An engineer says GDPR rules the vendor out.

As of the General Court's judgment of 3 September 2025 (appeal C-703/25 P pending when read), which reply is right?

Pick one

Question 3 of 6

A streaming service runs a broadcaster's stamp in eu-central-1, and the broadcaster's contract keeps its viewers' data in the EU. The team plans for losing eu-central-1 entirely, which it assumes lasts 30 hours, and wants viewers back within 1 hour with at most 5 s of saves lost. Promoting a standby copy takes about 10 minutes; restoring nightly backups takes about 3 hours.

Which plan meets all of it?

Pick one

Question 4 of 6

An HR platform runs every customer on one stamp in eu-central-1, a 65 ms round trip from us-east-1 at the fibre floor; reading one staff member's record takes 2 ms of work. Two customers have staff in both regions: a US retailer with no limit on where its data goes, and a German bank whose contract forbids any copy of its staff's data outside the EU, though its lawyers confirm GDPR alone would allow a transfer to the US. The team needs the retailer's staff in the US to read records within 10 ms at p99, and the bank's contract kept.

Which change meets both?

Pick one

Question 5 of 6

A ticketing platform runs all 40 of its event promoters on one stamp in us-east-1: an app tier, a database, a file bucket, backups and logs. A 41st promoter, from France, requires its ticket buyers' data to stay in the EU, and the other 40 must not be moved.

Which change meets both?

Pick one

Question 6 of 6

A payments ledger runs in eu-central-1 and us-east-1, a 65 ms round trip apart at the fibre floor. Each merchant account gets about one entry a second, and 1 entry in 10 is written in the other region; an entry has its own id, is only ever added and never changed, and writing it takes 2 ms of work. Copies between regions arrive 1 s after a write. The team needs every write, from either region, confirmed within 20 ms at p99, no entry ever dropped, and at most the last 2 s of entries lost if a region is lost.

Which design meets all three?

Pick one

Go deeper

Pro tips
  1. Before any residency promise, run a search for one test user's id and email across every store you operate, outside providers included, and list where it turns up. When: a customer asks for data to stay in one jurisdiction and the team plans to move only the database (steps 9–10). Verify:
    tip one search for the test candidate's id and email across 6 stores: found in 5 (primary, video bucket copy, backups, error tracker, logs), 3 of them outside the EU
    Status: RAN.
Source

quote-check.mjs finds every passage below verbatim in its saved text. The transfer rule holds as of the General Court's judgment of 3 September 2025 (appeal C-703/25 P pending when read).

  • GDPR Article 44, General principle for transfers (Regulation (EU) 2016/679), gdpr-info.eu: https://gdpr-info.eu/art-44-gdpr/ (gdpr-art-44.txt). The row's first source. Quoted: "shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor". Supports step 11.
  • GDPR Article 45, Transfers on the basis of an adequacy decision, same regulation and site: https://gdpr-info.eu/art-45-gdpr/ (gdpr-art-45.txt). Article 44 names Chapter V's conditions; Article 45 is the next article of that chapter, read as the standard itself. Quoted: "A transfer of personal data to a third country or an international organisation may take place where the Commission has decided".
  • Court of Justice of the EU, Press release No 106/25, Judgment of the General Court in Case T-553/23, Latombe v Commission (3 September 2025): https://curia.europa.eu/site/upload/docs/application/pdf/2025-09/cp250106en.pdf (curia-latombe-cp250106.txt). The row's second source; the row notes an appeal, C-703/25 P, pending (not fetched; this lesson keys nothing on it). Quoted: the claimant "asked the General Court to annul the contested decision."
  • Azure Architecture Center, Deployment Stamps pattern: https://learn.microsoft.com/en-us/azure/architecture/patterns/deployment-stamp (azure-deployment-stamp.txt). The row's third source. Quoted: "To achieve low latency or comply with data sovereignty requirements, you might deploy some customers to specific regions."; "Each copy is called a stamp , or sometimes a service unit , scale unit , or cell . In a multitenant environment, each stamp serves a predefined number of tenants."; and "Stamps run independently, but they aren't inherently redundant across regions."

Steps 1, 3–8 and 10 are what lib/regions.mjs runs, not quoted rules; step 1's floors are the prerequisite's.

Related lessons

Checked against the tools and docs as of 2026-10-15.