SOV-3-01 Data Residence

A cloud service customer MUST be able to check where their cloud service derived data, cloud service customer data, and account data are stored and processed.

The cloud service provider MUST provide a service option where cloud service derived data and account data are exclusively stored and processed in the EU.

The cloud service provider MUST provide a service option where cloud service customer data is exclusively stored and processed in the EU.

The cloud service provider MUST provide a service option where cloud service customer data is exclusively stored and processed in Germany.

The cloud service provider MUST provide a service option where cloud service provider data is exclusively stored and processed in the EU.

If a cloud service provider operates in other locations/regions in addition to the EU or Germany, the location/region of processing and storing MUST be clearly identifiable for the cloud service customer.