What Is Data Residency? A Guide for E-Signature Documents

Data residency is the physical location where your data is stored, usually a country or region you choose with your provider. For e-signature documents, it decides where your contracts, signed copies, and signing evidence live at rest. It doesn't, on its own, decide which laws apply to that data, and it rarely covers every piece of data a service handles.

That gap between "where it's stored" and "what that actually covers" is where most of the confusion sits, so let's take it apart.

What is data residency?

Data residency describes where data sits geographically. When a provider offers data residency, you pick a location, such as Frankfurt, Toronto, or Tokyo, and your stored data is kept in data centers there.

Companies ask for it for three main reasons:

• Customer and contract requirements. Enterprise customers, public bodies, and procurement questionnaires often ask where documents are stored and may require a specific region.
• Internal policy. Many companies keep data close to where their customers and employees are, to simplify their privacy program.
• Specific laws. A few laws do require certain data to stay in a country. More often, laws restrict how data moves abroad, which is a different thing, covered below.

One detail matters more than any other: data residency usually refers to data at rest. Data can still be processed, cached, or backed up elsewhere unless the provider says otherwise.

What's the difference between data residency, data sovereignty, and data localization?

The three terms get mixed up constantly. They answer different questions:

• Data residency is where the data is stored. It's usually a choice you or your provider make.
• Data sovereignty is about whose laws apply to the data. That depends on where the data is, but also on who handles it and whose data it is. GDPR, for example, applies to companies outside the EU when they offer services to people in the EU, wherever the processing happens.
• Data localization is a legal requirement to keep certain data inside a country. It is residency that the law makes mandatory.

So choosing a region gives you residency. It doesn't automatically give you sovereignty, and it only matters for localization if a law actually requires it for your data.

Does GDPR require data residency?

No. This is the most common misunderstanding about data residency. The EU General Data Protection Regulation (GDPR) doesn't require personal data to be stored inside the EU. Instead, Chapter V of the GDPR controls transfers of personal data to countries outside the EU.

A transfer is allowed in a few ways:

• Adequacy decisions. The European Commission can decide that a country offers an adequate level of protection. Transfers there need no extra authorization. Countries on the list include Switzerland, the United Kingdom, Japan, Canada (for commercial organizations), and the United States for companies in the EU-US Data Privacy Framework.
• Appropriate safeguards. Where there's no adequacy decision, companies can use tools such as the Commission's standard data protection clauses or binding corporate rules.

Storing data in the EU can make your transfer analysis simpler, but it doesn't make you GDPR compliant on its own, and storing it outside the EU doesn't make you non-compliant. Switzerland works the same way: its Federal Act on Data Protection (FADP) allows personal data to go abroad to countries the Federal Council considers adequate, or with safeguards such as approved standard clauses.

Which laws actually require data to stay in a country?

True localization rules exist, but they're narrower than most articles suggest. China is a well-known example: its Personal Information Protection Law requires critical information infrastructure operators, and companies handling personal information above set volumes, to store personal information collected in China inside the country, with a security assessment before it goes abroad.

In the US, healthcare is often assumed to require domestic storage. It doesn't. The US Department of Health and Human Services says HIPAA allows a covered entity to use a cloud provider that stores health data on servers outside the United States, as long as there's a Business Associate Agreement (BAA) and the other HIPAA requirements are met. It also notes that risks can vary by location, which is why many healthcare organizations still choose a domestic region.

Beyond national law, requirements often come from contracts, sector regulators, or a customer's own policy. Check with your legal team which rules apply to your data before you pick a region.

Why does data residency matter for e-signature documents?

Signed documents are some of the most sensitive files a company keeps. A single employment contract can hold a home address, a salary, and a bank account. A patient consent form carries health information. And every signature comes with personal data about the signer: name, email address, IP address, and sometimes an ID check.

That's why data residency questions show up in so many procurement reviews for e-signature tools. The question isn't just "where are documents stored?" It's "which parts of the signing process stay in that region?"

What stays in your region in an e-signature workflow?

A signing workflow creates more than one file. When you evaluate a provider, look at each of these separately:

• Documents at rest: the files you send for signature and the completed, signed copies.
• Signing evidence: the audit trail and completion certificate that prove who signed and when.
• Signature images: the signatures and initials your users save for reuse.
• Backups: where copies are kept for recovery, and whether that's the same region.
• Metadata: account details, billing records, and information about documents, such as titles and status.
• Processing copies: temporary files created while a document is converted, sent, or signed.
• Thumbnails and caches: preview images kept for fast display.

Providers draw these lines differently, and the honest ones document them. If a provider only says "your data stays in the region," ask which of the items above that sentence covers.

How do you choose a data residency region?

Start from your obligations, not from the map:

• Where your customers and employees are. Keep documents close to the people they're about, especially if a contract or regulator expects it.
• What your contracts promise. Customer agreements and data processing agreements sometimes name a region outright.
• Your sector. Healthcare, finance, and the public sector often have extra rules or expectations.
• Where your backups should live. Some teams want backups in the same region, others want a second region for resilience.
• Whether you may need to move later. A region you can change without losing features gives you room as your business grows into new markets.

What should you ask your e-signature provider about data residency?

• Which regions can we choose, and on which plans?
• Exactly which data moves to the region: documents, signed copies, audit trails, signature images, backups?
• Which data is processed or stored outside the region, and for how long?
• Can backups go to a different region from live data?
• Can we change regions later, and what happens to existing documents?
• Which subprocessors are involved, and where are they?
• Are there other storage options, such as keeping completed documents in our own storage?

How does data residency work in Sign.Plus?

Sign.Plus is built by Alohi, a Swiss company headquartered in Geneva, and by default stores signed documents in Swiss data centers, one in Geneva and one deep underground in Zurich, in a former military command center.

On the Enterprise plan, Owners and Admins can choose another location in Settings, under Security, from more than 40 locations across the Americas, Europe, Asia Pacific, the Middle East, and Africa. Live data and backups can go to the same region or to different ones, and changing regions doesn't change your plan's features.

Here's exactly what that covers, because the details matter:

• Stored in your chosen region: signed documents, documents sent for signature, Certificates of Completion, and users' signature images. Backups of signed documents go to your backup region.
• Always processed in Geneva or Zurich: raw uploaded files, which are deleted after conversion and no later than one hour after upload; metadata about documents, the account, and billing; and cached thumbnails.
• When you switch regions: new documents go to the new region right away, and existing documents move over in anything from a few minutes to several days, depending on volume.

If you'd rather keep completed documents on your own infrastructure, Enterprise customers can also archive them through the API or have Sign.Plus upload each completed document to an S3-compatible bucket they own.

All of this sits on a platform certified to ISO/IEC 27001:2022 by EY CertifyPoint, with a SOC 2 Type 2 report from EY. Documents are encrypted with TLS 1.2 or higher (TLS 1.3 supported) in transit and AES-256 at rest. For more on the wider security picture, see our guide to electronic signature security best practices, and if you work with patient data, our page on HIPAA-compliant e-signatures.

Need documents stored in a specific region? See the Enterprise plan and talk to our team about data residency.