Data residency = data must stay in specific geographic region. Driven by regulation (GDPR, GDPR-like laws, industry-specific rules).
Implementation options:
1. Multi-org with regional Salesforce instances.
- EU org with EU data center.
- US org with US data center.
- APAC org with APAC data center.
This is the most common solution. Salesforce data centers in multiple regions; choose at provisioning.
2. Hyperforce for region selection.
- Hyperforce supports multiple regions.
- Newer orgs can choose region.
3. Encryption with region-specific keys.
- Data encrypted with region-specific key.
- Decryption only possible in that region.
4. Restricted access.
- Access restricted to users in approved geographies.
- IP-based restrictions.
Architecture decisions:
1. What data is regulated?
Not all data. Typically PII / sensitive customer data.
2. Strict vs lenient interpretation.
- Some regulations are strict (must be physically in region).
- Some allow data to leave with safeguards.
3. Cross-region operations.
- If a customer in EU has support in US, support agent needs access to data.
- Compliant architectures for this exist (controlled access, audit, cross-border safeguards).
4. Backup / DR.
- Backup to in-region storage.
- Cross-region DR may not be allowed.
5. Integration.
- External systems also region-locked.
- Integration may not cross regions.
Salesforce-specific:
- Salesforce data center selection — choose at org creation.
- Hyperforce regions — expanding.
- Salesforce Trust documentation on data residency.
- Salesforce contracts specify location.
Common pitfalls:
- Multi-region single org can violate residency — verify with provider.
- Backup to wrong region — leaks data.
- Integrations cross-region — review.
- AI / ML training on regulated data — usually problematic.
Senior architect insight: data residency is binary. Either compliant or not. Get it right or don't operate in that region.
The senior framing: engage compliance / legal early. Architectural decisions about residency have legal consequences.
For multinational organisations, residency typically drives multi-org architecture. Plan accordingly.