# Data Residency

Source: https://customlabs.io/glossary/data-residency/
Updated: 2026-09-13

Security & governance

# Data Residency

Data residency is where data is physically processed and stored, not where users are located.

A model API call can route through a different region than the rest of your stack.

The residency question must be answered per provider, not assumed from your hosting region.

It matters most once a privacy notice or a framework like GDPR makes a specific commitment.

At that point residency becomes something reviewers check against what you actually promised.

[AI Security Review](https://customlabs.io/security-review/)

[← Back to the full glossary](https://customlabs.io/glossary/)

## Related terms

[High-Risk AI System A high-risk AI system is one classified as carrying enough decision impact to trigger heavier compliance.](https://customlabs.io/glossary/high-risk-ai-system/)[Data Processing Agreement (DPA) A DPA is the contract naming a vendor as a processor of personal data.](https://customlabs.io/glossary/data-processing-agreement/)

## More in Security & governance

[Red Teaming Red teaming is deliberately attacking your own AI system to find what breaks first.](https://customlabs.io/glossary/red-teaming/)[AI Register An AI register is a current list of every system that touches a model.](https://customlabs.io/glossary/ai-register/)[Human Oversight Human oversight is a checkpoint where a person can meaningfully approve, reject, or intervene.](https://customlabs.io/glossary/human-oversight/)[System Card A system card is a short document stating an AI system's purpose, limits, and owner.](https://customlabs.io/glossary/system-card/)