The data residency evidence pack

Each yes scores one point.

1. 1.A data map. Every data store with its region and the encryption key that protects it.
2. 2.The region policy, with proof that it works. The service control policy that denies other regions, plus a screenshot of a denied call to a non-EU region.
3. 3.A sub-processor list with locations. Every provider that touches customer data, what it does, and where.
4. 4.A report of resources outside the approved regions. From an AWS Config aggregator or Resource Explorer. The right answer is a short list of global services, and nothing else.
5. 5.A record of what still leaves the EU. Account metadata, billing, identity configuration, and some service logs sit in US regions whatever happens. Each one goes on the list as a transfer, with its legal basis.

I highly recommend bringing the data-location question from your last security questionnaire to a thirty-minute call. We'll mark what already has proof and what's still sitting in Virginia. What did your last answer to that question say?

These takeaways are an engineer's reading of the rules and the tools. I wrote them to help teams decide what to build. They aren't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.