Data residency

What it is#

Data residency refers to the physical, geographic location where a service stores and processes data — and, more practically, to the rules that govern where that data is allowed to live. A client with a data-residency requirement is saying their data must remain within a specified region (often the EU, the UK, or a specific country) and not be moved or processed outside it.

Residency is related to but distinct from data sovereignty, which adds the question of whose laws apply to the data once it's there.

Why it matters for agencies#

Data-residency requirements travel down the chain. If an agency's client is bound by a residency rule — common for clients in regulated industries, public-sector work, or the EU under GDPR — then the agency is bound by it too, and so is every tool the agency uses to handle that client's data.

This means an agency evaluating a reporting tool for a residency-sensitive client has to ask not just "where does this vendor store data?" but "where do its sub-processors store data?" A residency commitment is only as strong as its weakest sub-processor.

In SendBriefs specifically#

SendBriefs documents where data is stored and processed, and which sub-processors are involved, on the Trust & security page — the information an agency needs to answer a client's residency question accurately rather than optimistically.