Where is business data stored in a managed cloud environment?

Business data in a managed cloud environment is normally stored within the cloud provider’s allocated storage infrastructure in one or more selected geographic regions. It is not usually held on one identifiable computer. Instead, the service may use a combination of storage systems, processing resources and replicated copies, presented to the business as a single managed service.

The physical location of data depends on the cloud design and the terms agreed with the provider. A business may choose a specific country, region or group of regions, subject to the provider’s available services. Some environments keep primary data within a defined jurisdiction, while others distribute it across locations to support resilience or service operation. The location should therefore be confirmed in the service documentation rather than assumed from the provider’s head office or the address of the business using it.

It is also important to distinguish between different types of information. The main business files or database records may be stored in an agreed region, but associated information can follow different rules. This may include:

• user account and access information;
• system logs showing activity and changes;
• backup and recovery data;
• configuration information for applications and devices;
• support records and diagnostic information; and
• temporary working data created while an application processes a task.

These supporting datasets can be relevant to privacy, contractual and regulatory requirements. A data-location review should therefore cover the complete flow of information, not only the folder or application where employees see their files.

Logical storage and physical storage are different. Users generally work with a logical location, such as a document library, database or cloud application. Behind that interface, the provider manages storage volumes and infrastructure that may change as capacity, maintenance and service requirements change. The business may not know the identity of an individual physical disk, and normally does not need to. What matters is that the provider defines where the service operates, how data is handled and which controls apply to the underlying infrastructure.

A managed cloud environment may use dedicated resources, shared infrastructure or a combination of both. Shared infrastructure does not mean that one customer can access another customer’s information. Proper isolation is implemented through account boundaries, permissions, application controls and storage architecture. The required level of separation should be considered alongside the sensitivity of the data, the organisation’s risk profile and any contractual obligations.

Before selecting an environment, a business should document:

• which data must remain within a particular country or region;
• which applications create, process or retain that data;
• where associated logs, backups and support information are held;
• which provider organisations or subprocessors may handle it;
• how long each category of information is retained; and
• what happens to the data when the service is changed or closed.

Data residency is not the same as data security or legal compliance. Keeping information in a preferred country may support a business requirement, but it does not by itself control who can access the information, how it is used, or whether the service meets the relevant rules. Those questions require consideration of permissions, administrative access, contractual terms, audit information, retention and deletion processes.

Cloud providers may also operate support, security or administration functions from locations different from the location where the main data is stored. This can create a distinction between the place where content is hosted and the places from which authorised personnel or service systems can access it. That distinction should be addressed during due diligence, particularly where sensitive personal, financial, intellectual property or commercially confidential information is involved.

For a small or medium-sized organisation, the practical approach is to create a data-location record for each major cloud service. Record the service, the data it contains, its primary region, any replication or backup regions, the relevant provider terms and the person responsible for reviewing changes. This makes it easier to assess new applications and prevents data residency decisions from being made informally by individual users.

S2 Technology Group can help a business assess its information requirements, map how data moves between systems and select a managed cloud arrangement that fits its operational, security and compliance needs. The result should be a documented design showing not only where the principal data is held, but also how related information is administered, retained and removed.