Data residency in the cloud means that data is stored and processed only in datacentres inside a defined area; AWS, Microsoft and Google provide region choice and location policies for it, each with exceptions, and the bill follows through regional prices, missing services and copies inside the area. Data residency answers where data sits and where it is processed. Who operates a service and which law can reach it is a separate question, covered in the sovereign offerings of the hyperscalers. This page describes the controls as the providers document them, and their cost; whether a configuration meets a legal requirement is for your legal adviser to decide.
How it works
All three providers commit to keeping customer data in the region or area the customer chooses, and all three define what counts as customer data: each leaves out metadata such as resource names, tags and labels, or billing data, in its own way. How region restrictions work as guardrails is covered in guardrails and approval thresholds.
AWS
The customer chooses the regions where its content is stored. AWS commits to keeping it there unless a service the customer started needs it elsewhere or a law or binding government order requires a transfer. Account information, which AWS says includes billing information, is not customer content and falls under the AWS Privacy Notice. AWS advises against personal or confidential data in tags, since billing and many other services read them. Across an organisation, a policy using the aws:RequestedRegion condition key, or the Region deny control of AWS Control Tower, blocks every region not on the list. Global services stay outside it: CloudFront, IAM, Route 53 and Support have a single endpoint in a US region and would otherwise be blocked, and Control Tower exempts IAM and AWS Organizations among others.
Azure
For regional services such as virtual machines, storage and SQL Database the customer picks the region; customer data then stays in the chosen Geo, except for a list of named services, and Microsoft may copy it to another region of the same Geo, as geo-redundant storage does. Services without a region choice, Microsoft Entra ID and Azure Content Delivery Network among them, may hold data worldwide. The EU Data Boundary goes further: customer data and pseudonymised personal data stay in EU and EFTA countries, with documented exceptions such as remote access by personnel outside the boundary and transfers the customer starts. Resource names and technical settings count as configuration, not customer data. The built-in Azure Policy definition Allowed locations restricts the regions for new resources but excludes resource groups and resources in the global region.
Google Cloud
The organisation policy constraint for resource locations (gcp.resourceLocations) allows new resources only in the locations listed, for example through the value group in:eu-locations. It applies only to newly created resources, not to global ones, and Google states that it is not a data storage commitment; those commitments are in the Service Specific Terms. With Assured Workloads the customer creates a folder and selects a control package such as EU Data Boundary, and Assured Workloads then restricts the regions available in that folder. According to Google, customer data does not include resource identifiers, attributes or labels, and service data such as billing data is stored as its geography and regions documentation describes.
What it means for your cost
Residency costs money where it removes choice. This table maps each typical requirement to its control and its cost effect:
| Requirement | Control | Cost effect |
|---|---|---|
| Data only in named regions | region restriction: aws:RequestedRegion or Control Tower, Allowed locations, gcp.resourceLocations | cheaper regions outside the area drop out (cloud region price differences in Europe) |
| Copies and disaster recovery inside the area | a second region in the area; at Azure, geo-redundant storage within the Geo | a second storage copy plus transfer between regions (backup, snapshots and disaster recovery) |
| Regional services only | service list per region, non-regional services checked | a substitute or a changed architecture where a service is missing |
| AI processing inside the area | data zone deployments, geographic inference profiles, EU endpoints | higher prices or later model availability than global options |
| Control package with evidence | Assured Workloads, Microsoft Sovereign Cloud controls | surcharges or extra services, depending on the package (sovereign offerings) |
For AI models, residency is a price tier. Microsoft says the global deployment type in Microsoft Foundry has the lowest price and gets new models first, ahead of data zone and geography-based types. On Amazon Bedrock, geographic inference profiles, such as the EU one, run at standard prices, while global profiles save about 10% according to AWS. At Google, requests to a global endpoint may be processed anywhere, and the EU endpoint keeps processing within EU member states. How these tiers appear on the price lists is covered in AI model pricing and rate cards.
Data transfer between two regions inside the same area is charged like any other transfer between regions (data transfer and egress). The cost questions raised by Microsoft's sovereignty controls are set out in Microsoft Sovereign Cloud: compare controls and cost correctly.
Where it goes wrong
- A global service outside the boundary. Symptom: an audit finds data outside the area although other regions are blocked. Cause: global and non-regional services such as IAM, CloudFront, Microsoft Entra ID, Azure CDN or Google's global resources are not covered by the region restriction.
- Backups or logs in another region. Symptom: copies or logs sit outside the area. Cause: a backup target, replica or log destination was created before the restriction; at Google the location policy applies only to new resources.
- Residency inferred from the region. Symptom: resource names, labels or billing data are treated as if they stayed in place. Cause: the providers' commitments cover customer data, not metadata or billing data. Personal data in cost data is covered in GDPR and cost data.
- "EU" means something else at each provider. Symptom: a region passes one provider's control and fails another's. Cause: Microsoft's EU Data Boundary includes EFTA countries such as Switzerland but not the United Kingdom; Google's
in:eu-locationsvalue group and its EU endpoint for AI models leave out London and Zurich. - Cheaper regions ruled out without a requirement. Symptom: the restriction allows one country while the requirement names the EU. Cause: the policy is narrower than the requirement, and every service pays the price gap.
- A restriction laid over running resources. Symptom: after the Region deny control is switched on, resources can no longer be reached. Cause: AWS warns that existing resources in denied regions become inaccessible.
Example
Azure Blob Storage, hot access tier, in Germany West Central, list prices in US dollars for the first 50 TB per GB-month, read on 2026-10-16: locally redundant (LRS) USD 0.0196, zone-redundant across three zones (ZRS) USD 0.0225 and geo-redundant (GRS) USD 0.0392, plus USD 0.02 per GB for geo-replication data transfer. Geo-redundant storage copies to a second region in the same Geo, and the region list names Germany North as the pair of Germany West Central. A second copy in Germany thus doubles the storage price against LRS (0.0392 / 0.0196 = 2.0), while the copy across three zones of one region costs 14.8% more (0.0225 / 0.0196 = 1.148). The redundancy levels themselves are compared in block, object and file storage.
Sources
Read on 2026-10-16. AWS data privacy FAQ, denying access based on the requested Region, Region deny control in AWS Control Tower, best practices for tags and cross-Region inference in Amazon Bedrock; Microsoft What is the EU Data Boundary?, continuing data transfers of the EU Data Boundary, data residency in Azure, built-in Azure Policy definitions, Azure regions list, deployment types in Microsoft Foundry, Azure Retail Prices API and Blob Storage pricing; Google Cloud restrict resource locations, data residency in Assured Workloads and data residency in Gemini Enterprise Agent Platform.