Glossary · Privacy & regulation
Data residency
Data residency is the physical or jurisdictional location where an organization’s data is stored — a deliberate infrastructure choice, distinct from data sovereignty, which concerns whose laws govern that data regardless of where it sits.
Residency is an operational fact: which country or region the servers and backups physically live in. Organizations choose residency for latency, regulatory alignment, or customer expectation — a company promising EU data residency commits to keeping storage and processing within EU/EEA borders, which simplifies GDPR cross-border-transfer analysis because there’s no border being crossed for that data flow.
Residency alone doesn’t fully answer where legal authority reaches; a server physically located in one country can still be subject to another country’s law if the operating company is headquartered elsewhere and subject to extraterritorial legal process — that broader question is data sovereignty. Residency is nonetheless the practical lever most organizations can control directly, since it’s a hosting decision rather than a matter of corporate domicile.
Ciphera hosts its infrastructure on Exoscale in Zurich, Switzerland (availability zone CH-DK-2) — data residency chosen specifically for Switzerland’s data protection regime (the FADP) and the EU’s adequacy recognition of it, independent of Ciphera BV’s own incorporation in Belgium.