What Data Residency Means
Data residency is the answer to a simple question: where does your data physically live? For cloud software, that usually means the country or cloud region of the servers that store and process it, such as Mumbai, Frankfurt or Virginia. It also covers backups, logs, analytics copies and the systems of subprocessors that touch the data.
Residency is a property of a vendor's setup that customers increasingly ask about during procurement. Security reviews, legal teams and enterprise customers want to know which jurisdictions their data passes through, because that affects which laws apply, which authorities can request access, and what transfer safeguards are needed.
Residency, Localisation and Sovereignty
Three related terms are often mixed up. Data residency is where data is stored, which may be a business choice. Data localisation is a rule that certain data must be stored, or sometimes also processed, inside a particular country. Data sovereignty is the principle that data is subject to the laws of the place where it resides.
A company can choose Indian residency for latency or customer preference without any localisation requirement. A regulator can impose localisation on payment data regardless of the company's preference. Sovereignty explains why both matter: once data sits in a country, that country's laws reach it.
What the Laws Say
Most general data protection laws regulate transfers rather than mandate residency. GDPR allows personal data to leave the EEA if the destination has an adequacy decision or if safeguards such as standard contractual clauses are in place, along with an assessment of the destination's laws. India's DPDPA allows transfers abroad except to countries the government restricts by notification. US state laws such as the CCPA focus on disclosure and opt-outs rather than location.
Sector rules can be stricter. In India, the Reserve Bank of India requires payment system data to be stored in India, and other regulators have their own requirements. Public sector, healthcare and financial services customers often add residency clauses to contracts even when the law does not require it.
This entry explains the concepts. Your obligations depend on your sector, users and contracts, so involve your legal team.
Why Residency Matters for Mobile Measurement
An MMP holds a lot of data about your users: device identifiers, IP addresses, install and event histories, revenue, and sometimes hashed emails or phone numbers. That makes it a significant data processor in your privacy program. Where it stores that data affects your transfer assessments, your privacy disclosures and sometimes your ability to sell to enterprise or regulated customers.
Residency also affects practical things such as latency for real-time APIs, how quickly exports and raw data reach your warehouse, and which regions your incident response plans need to cover.
Data Residency in Linkrunner
Linkrunner hosts data in India, in Google Cloud's asia-south1 region. For teams that need data to stay in their own environment, Bring Your Own Cloud runs Linkrunner inside the customer's cloud account, on GCP first with AWS planned, at $0 per attributed install, with RBAC and SSO for operator access. Linkrunner also offers a data processing agreement at /legal/dpa and a list of subprocessors, and its security posture is summarised on the Trust Center.
Questions to Ask Any Vendor
Ask where production data is stored and processed, and where backups, logs and analytics replicas live. Ask for the subprocessor list with locations. Ask how data moves between regions and what safeguards cover those transfers. Ask whether you can choose a region or host the platform in your own cloud. And ask how deletion requests are carried out across every copy, including backups. Clear answers to these questions usually tell you more about a vendor's maturity than any badge.
Residency in Contracts and Reviews
Residency questions usually arrive through a security questionnaire or a contract clause. Prepare answers once and keep them current: where each category of data is stored, which subprocessors process it and in which countries, how transfers are protected, and how long data is kept.
Read customer contracts carefully. Some clauses require data to stay in a named country, others only require notice before data moves, and others require the right to audit. A clause that says "data must not leave India" may cover backups, support access and logs, not just the primary database. Clarify scope before signing.
For your own vendors, keep a register of where each one stores your users' data. MMPs, analytics tools, CRMs, support platforms and cloud providers all count. When a customer or regulator asks where their data lives, the register lets you answer accurately in hours instead of weeks.