← Back to Concept Contrast

Concept Contrast Fable

Private deployment and data residency: one governs who touches the machines, the other governs where data sleeps

Conclusion first:Private deployment determines the ownership and isolation method of computing resources and systems, while data residency determines the geographic location of physical data storage and restrictions on cross-border movement. The two are often crammed into the same column of the same security questionnaire, but the compliance risks actually fall under different clauses.

Private deployment determines the ownership and isolation method of computing resources and systems, while data residency determines the geographic location of physical data storage and restrictions on cross-border movement. The two are often crammed into the same column of the same security questionnaire, but the compliance risks actually fall under different clauses.

Fable

There is a message station built on the other side of the state line

The prefecture's message station relayed household registries, tax ledgers, and litigation transcripts for the counties. The Qingzhou prefect, worried about outsiders prying, required the message station to set up a branch archive within the prefecture compound, with keys held jointly by the prefecture and the station chief, and no outside personnel allowed in.

After the branch repositories were built, the prefect was reassured: clerks retrieved scrolls in their own courtyards, and the gatekeepers recognized them. But half a year later, the judicial officer discovered that a batch of household registration copies had been sent to an old repository outside the border, saying that the humidity control there was better and the rent lower. There were branch repositories within the prefectural office, but the account books' copies slept elsewhere.

The stationmaster explained that the people handling matters and the counter were both in Qingzhou, and who could enter the vault was also governed by Qingzhou's rules. The investigating official asked in return: then where are the account books themselves ultimately kept? Are the copies, old volumes, sealed volumes and reference volumes all kept in this prefecture? If the law requires that they not leave the prefecture, just managing the entrance is far from enough.

The prefecture therefore rewrote the contract. The first part stated "who guards it, who opens the cabinet, who can enter the vault," stipulating that branch vaults were within the prefecture compound and that keys and personnel were managed locally. The second part stated "where the files live," stipulating that originals, copies, old transcriptions, and disaster-recovery transcriptions must not cross the prefectural boundary, and that any transfer of the vault required prior approval.

Later, neighboring states also bought message station services. Some only required that case files remain in their own state and did not mind remote scheduling of scribes by the main station; others required that counters, personnel, and case files all be within their own courtyard. Both appear to be talking about "keeping it here," but they actually govern different levels.

The judicial officer finally drew two lines for the newcomer: one circled the place of business and custody rights, the other circled the region where the account books ultimately reside. The former answers who is in charge, the latter answers where things sleep. Draw only one line, and compliance will eventually leak.

Later, when a flood occurred, Qingzhou wanted to restore household registrations from the backup volumes. Only then did the clerks discover that the in-house branch storage was normally guarded by locals, but the disaster-recovery copies had been sent to an out-of-state mountain vault under the old head-station rules. The prefect did not blame the gatekeeper, because the gatekeeper had indeed been dutiful; he instead asked whether the contract clearly stated the final resting place of each type of volume. After that day, when the prefecture accepted deliveries, it first looked at two lists: where people handled business, and where volumes spent the night. Later the head station proposed replacing the regional commitment with stricter access control. The judicial officer refused: access control can govern who reaches out a hand, but not where the volumes are placed on which piece of land. Only when the two lists are kept separate can responsibilities avoid covering for each other.

Private deployment

System resources are exclusive to a specific customer, answering "whose thing it is and who manages it." It focuses on isolation and access control of computing resources, and does not directly constrain the physical location of data.

Data residency

Physical data storage must be confined to a certain geographic region; it answers the question of "where the data is kept." It is bound by the data protection laws of various countries and directly determines compliance boundaries.

Story Mapping

  • The message station in the courtyard: private deployment in place, physical isolation and access control meeting standards
  • Hard drives moved to an overseas hosting facility: data residency breached, physical location crossed the compliance boundary
  • The security questionnaire only wrote private deployment: two dimensions were merged into one entry, and the audit found it was a systemic loophole
  • A neighboring state's new compliance policy triggers a chain of violations: data residency requirements are independent of the deployment plan, and a policy change exposes it immediately
  • Deployment on the left, residency on the right: the two dimensions watch budget and risk against each other, but cannot substitute for each other
  • During scaling, passing one dimension does not mean the other meets the bar: every architecture change requires separate review across both dimensions

Translating into security questionnaires and compliance reviews

When filling out the security questionnaire, answer 'private deployment' and 'data residency' in two separate columns. Private deployment answers whose system, whose permissions, and who operates it; data residency answers in which jurisdiction the primary copy, backups, and logs of the data reside. When customer budgets are tight, the most common mistake is using one dimension's compliance to argue that another dimension is fine—during an audit this counts as a questionable control gap. If a vendor answers all data compliance questions with one sentence—'we are privately deployed'—require them to list storage locations item by item by jurisdiction.

京ICP备2026014272号