Data residency and governance
Restrict resource locations, recovery destinations, exports, and policy exceptions.
Residency policies constrain where project workloads and their managed data can be placed. Governance records policy changes, exceptions, and evidence needed for an organization's review process.
Policy scope
Apply allowed-region policy to droplets and live volumes, then review every copy path separately. Snapshots, images, and backups can have their own approved copy destinations. Logs, metrics, and audit exports can leave a region through observation and archive integrations even when compute stays local.
Control-plane metadata follows the hosted deployment terms or the self-hosted services selected by the installation administrator. A project's allowed compute region alone does not establish the location of that metadata.
Configure allowed locations
Open Organization settings → Governance → Residency and define organization requirements. Projects can narrow those requirements but cannot permit a location excluded by organization policy.
Creation and copy requests evaluate the effective policy. A disallowed target
returns policy_violation with the applicable policy and field. Existing
resources outside a new policy are reported for review; the policy change does
not silently move or delete them.
Backups and exports
Backup destinations declare their region and ownership. Infra checks that configuration against policy, but an external provider's actual storage behavior must be established through the organization's provider agreement and controls.
Exports can contain resource names, addresses, labels, journal data, and actor identifiers. Restrict export access and approve destinations separately from ordinary resource read permissions.
Exceptions
A permitted exception identifies its scope, owner, reason, allowed action, and expiry. Approving one project action does not remove the organization policy for unrelated resources. Exception creation and use are audited.
Expiry prevents new actions relying on the exception. It does not automatically delete resources already created. The governance view lists those resources for an explicit remediation plan.
Evidence
Use audit exports, backup verification results, patch inventory, role bindings, and regional resource inventory as evidence of configured controls. Retain the policy revision that applied during the reviewed period.
An infrastructure setting or exported report does not itself establish a certification. Use the relevant agreement and formal assessment for certification scope and obligations.
Self-hosted boundaries
A self-hosted control plane stores configuration and operational metadata in its configured services. The Connector exchanges the metadata needed to operate selected hosted resources. Local workload disk contents are not copied to hosted regions unless an operator configures a transfer, backup, or hosted deployment that requires it.
Review Architecture and Configuration when designing isolated or restricted-network installations.
Use policy exceptions and holds to distinguish permission to admit an otherwise forbidden action from an obligation to retain recovery data. Neither can override unresolved storage ownership or a provider retention lock.
Use compliance evidence for assurance material and regulated deployment review, and signed audit manifests for export verification. Report scope and deployment configuration remain separate evidence boundaries.