What Is Data Residency?
Data residency is the physical location where data sits when it is at rest — which country, and sometimes which region, holds the disks.
It is a narrow claim, and its narrowness is the point. "Our data resides in Frankfurt" says where the bytes are stored. It does not say who can read them, which jurisdiction's courts can compel their disclosure, or where they travel while being processed. Those are three different questions, answered by data sovereignty, by law, and by an architecture diagram respectively.
Residency Is About Rest, Not Motion
The distinction that most often goes missing: data has a location while stored and a set of locations while being worked on, and these need not overlap.
A translation platform can store every uploaded file on infrastructure in one country and still send the text of those files to a model API hosted in another, because the translation itself happens there. Nothing about the storage claim is false. It simply answers a question nobody was really asking.
This matters because the regulatory question is usually about transfer, not about storage. Under Russian law, for instance, the act of calling a foreign API is itself a cross-border transfer of personal data — the absence of a stored copy abroad does not change that.
Why Organizations Ask About It
Residency requirements reach a vendor through several routes, and it is worth knowing which one applies:
- Sectoral regulation — banking, health and government data often carry an explicit storage-location rule.
- Contractual commitments — an enterprise customer's own obligations passed downstream to its suppliers.
- Procurement policy — an internal rule with no statutory basis, which is nonetheless a real requirement for the vendor facing it.
- Latency and cost — an engineering reason wearing a compliance vocabulary.
The first three can look identical in a questionnaire and imply very different things about what a truthful answer must cover.
What an Honest Answer Looks Like
A vendor answering a residency question well separates the parts:
- Where files are stored at rest, naming the provider and region.
- What leaves that boundary during processing, and to whom.
- What is retained afterwards, and for how long.
An answer that supplies only the first and lets the reader infer the rest is technically true and practically misleading — and it is the most common form of answer.
At KTTC, uploaded documents and finished translations are stored in a Russian provider's object storage (Timeweb Cloud S3). Translation and field extraction call external model APIs, so processing is not confined to that boundary. Those are separate facts about separate stages, and neither one substitutes for the other.
FAQ
Is data residency the same as data sovereignty?
No. Residency is a fact about geography — where the storage is. Sovereignty is a question about legal authority — whose law reaches the data, which can be a different country's than the one holding the disks.
Does storing data in a country mean only that country's law applies?
Not necessarily. A provider incorporated elsewhere may be subject to disclosure obligations under its home jurisdiction regardless of where its hardware sits. Residency constrains the physical answer, not the legal one.
If nothing is stored abroad, has any transfer occurred?
Very often yes. Most data protection regimes treat the transmission itself as the transfer — sending text to an API abroad is a transfer even if no copy is retained there.
Can a vendor guarantee residency for processing as well as storage?
Only if every processing dependency is also located inside the boundary, including model providers, OCR services and document converters. That is a much stronger claim than a storage one, and it should be asked for explicitly rather than assumed.