Episode 2 — Data residency, sub-processors, and what to ask your vendor

HostToday we are talking about data residency. Sara, when someone asks "is Faurenis EU-resident", what is the honest answer?

SaraThe honest answer is that residency is four things, not one. Storage, AI inference, backups, and support access. Faurenis is EU-resident on all four for EU tenants. But buyers should ask vendors to answer all four — many vendors only answer the first.

HostStorage seems easy. Where is the data sitting.

SaraYes, easy to verify. Most vendors will name a cloud region. Where it gets harder is inference. A vendor can store data in Frankfurt and still send each request to a US-hosted model. That is a transfer, and the DPIA has to capture it.

HostHow can a clinic verify inference residency?

SaraAsk the vendor to name the inference provider and the region for that provider. Faurenis uses EU-hosted model deployments for EU tenants. We can name the provider, the region, and the contract that binds them.

HostBackups and support access — what are the common gaps?

SaraBackups are often cross-region replicated by default for resilience. That is fine technically — and a real gap from a residency perspective. Faurenis keeps EU backups in-region. Support access is the most underexamined: a vendor might be EU-resident on data but have a US-based support team that can read it. Faurenis requires an in-region admin to grant time-boxed access for any cross-region support read.

HostWhat is the one question every clinic should put in their DPIA?

SaraAsk the vendor to list, by sub-processor, what data the sub-processor touches and what region it operates in. If the vendor cannot answer that crisply, the DPIA is going to take three months.

HostSara, thanks for the time.

SaraAnytime.