Defining what your company's stays-in-jurisdiction promise covers, where do you draw the line across copies, telemetry and operator access?

## The promise is a commitment, not a configuration When a company tells a customer "your data stays in country", engineering is not the author of that sentence — but engineering is the only party that can say what it costs and whether it is true. The failure mode is predictable: the sentence ships, each team reads it differently, and eighteen months later a reviewer asks where the backups are and three teams give three answers. The work a lead owns here is turning one marketing sentence into a definition that is the same in every team and checkable in every system. ## Rungs, because it is not one guarantee Write the promise as an ordered ladder, and name the rung the company actually sells. Each rung includes the ones below it. 1. **The primary store is in-jurisdiction.** The floor. It is what most teams already mean and it settles the least. 2. **Every copy is in-jurisdiction** — standby replicas and every retained backup generation. This is where the real engineering constraint appears, because the copy that protects against losing the whole region is the one that wanted to be far away. 3. **Derivatives are in-jurisdiction too** — exported logs, traces, metric labels, and what the management plane holds about the resource, including names and tags. 4. **No routine access from outside the jurisdiction** — operating and support staff are inside it, or each access is approved, scoped and recorded. 5. **The operator cannot read it alone** — a decryption requires a step you control and can withdraw. | Rung | What it adds | What it costs |---|---|---| | 1 Primary store | a placement decision | almost nothing | | 2 All copies | replicas and retained backups stay inside | a narrower recovery posture where the jurisdiction has one region | | 3 Derivatives | telemetry and metadata stay inside | a separate collection path, and redaction work in every service | | 4 Access | no routine outside operator access | slower support handling, and fewer fully managed options | | 5 Key | the operator cannot decrypt alone | operational burden, and a real risk of locking yourself out | The ladder is the deliverable. Teams cannot argue about a rung number the way they argue about a sentence. ## Per data class, not per company Applying rung five to the whole estate is the expensive mistake, and it is usually made by applying the strictest customer contract to everything. Classify instead: regulated customer records at the high rung, internal operational data at a low one, aggregate business reporting somewhere between. Each class then carries one rung, and a service that mixes classes either splits its stores or inherits the strictest one — which is itself a design pressure worth having, because it pushes teams to stop putting regulated content into general-purpose systems. ## Write the exclusions in the same document Every dispute I have seen comes from something nobody wrote down. So the definition names, explicitly: - which rung each data class is at; - what is **not** covered — for instance that aggregate counters with no identifying dimension may be collected centrally, or that a named class of internal logs is out of scope; - what happens when the jurisdiction has only one region, and who accepts the reduced recovery posture that follows; - who may approve an exception, for how long, and what evidence that exception requires. An exception path that exists and is recorded is far better than one that does not exist and is used anyway. ## Make it checkable, or it decays A definition nobody can test becomes folklore within two quarters. Three things keep it alive: - **An inventory per system** with a jurisdiction against each copy and each export, owned by the team and reviewed rather than written once. - **A control at the strongest available point for each rung.** For rung three that means redaction at the emitting service and a naming convention that forbids customer detail, not an alert after arrival — a control that reports a crossing did not prevent it. - **A named owner for the promise itself,** because the commitment is renegotiated with customers and the ladder has to move with it. ## What makes this a lead's call rather than a team's There is no single right rung. Rung five sounds responsible and costs real operational capability; rung one is cheap and will not survive a serious review. The judgment is which rung the business is actually selling, which data classes genuinely need it, and what the company is willing to give up in recovery, telemetry and support speed to say it truthfully. That trade cannot be made inside one team, because each team will make it differently and the customer sees one promise.