Data Residency Architecture Checklist Builder

Create a technical checklist for regional data residency, tenant routing, backups, logging, subprocessors, and migration risks.

Prompt Template

You are a senior software architect designing data residency controls for a production SaaS system. Build a cautious architecture checklist for the context below.

Product type: [B2B SaaS, consumer app, marketplace, healthcare app, fintech, internal platform]
Customer regions: [EU, US, Canada, Australia, UK, Middle East, single country, etc.]
Residency requirement: [store data in region, process data in region, support customer-selected region, avoid cross-border transfer]
Tenant model: [single tenant, multi tenant, shared database, database per region, hybrid]
Data types: [account data, content, files, logs, analytics events, billing, support tickets, backups]
Current architecture: [cloud provider, databases, queues, object storage, cache, search, analytics, observability]
Identity and routing: [tenant region field, user region, DNS, edge routing, auth claims, organization settings]
Subprocessors and integrations: [email, payments, support, analytics, AI APIs, logging, CDN, data warehouse]
Migration constraints: [existing customers, downtime tolerance, data volume, cutover window, rollback needs]
Compliance drivers: [contract terms, GDPR, public sector, financial services, healthcare, internal policy]
Operational constraints: [on-call coverage, cost, latency, disaster recovery, support tooling]

Produce:
1. Requirements map separating storage, processing, access, logging, backup, and support obligations.
2. Regional architecture options with tradeoffs for databases, object storage, queues, cache, search, and analytics.
3. Tenant-region routing design with failure modes and test cases.
4. Data classification table showing what can and cannot cross regions.
5. Subprocessor and integration review checklist.
6. Migration plan for existing tenants with dry run, validation, rollback, and customer communication steps.
7. Observability, audit logging, access control, and break-glass support design.
8. Disaster recovery and backup residency checks.
9. Engineering implementation checklist with owners and sequencing.
10. Open questions for legal, security, infrastructure, and customer success.

Make the checklist practical enough for an architecture review and explicit about assumptions that require legal or compliance confirmation.

Example Output

Residency Decision Summary

For EU enterprise tenants, account data, customer-uploaded files, search indexes, and backups must remain in eu-central-1. Aggregated product analytics may leave the region only after tenant identifiers and free-text fields are removed.

Architecture Checks

| Area | Requirement | Design Choice | Risk |

|---|---|---|---|

| Primary database | EU tenant records stay in EU | Region-specific Postgres cluster | Cross-region admin queries |

| Object storage | Files stay in chosen region | Bucket per region with tenant policy | Misrouted upload presigned URL |

| Logs | No free-text customer data in US logs | Redaction at SDK boundary | Debug logs bypass SDK |

Migration Guardrails

- Add tenant_region as immutable metadata before moving data.

- Run checksum validation for records, files, and search indexes.

- Block background jobs that do not include region-aware routing.

- Keep rollback snapshots in the same region as the source tenant.

Tips for Best Results

  • 💡Separate storage residency from processing residency; many requirements care about both.
  • 💡Include logs, support tools, analytics, AI integrations, and backups in scope because they are easy to miss.
  • 💡Ask for tenant routing details so the checklist can catch cross-region queues and background jobs.
  • 💡Treat legal interpretation as an input, not something the architecture prompt should invent.