Ai Data Residency Checklist — free AI tool

Residency controls — tick all that apply

• Data residency in customer's jurisdiction (EU / GCC / APAC / US) by architecture, not contract
• Customer-managed encryption keys (BYOK) via AWS KMS / Azure Key Vault / HashiCorp Vault / on-prem HSM
• TLS 1.3 in transit; AES-256 at rest with envelope encryption per region
• Sub-processor list disclosed, with 30-day change notification
• All sub-processors in same jurisdiction (or covered by SCCs / adequacy decision)
• Audit log export to SIEM (Splunk, Sentinel, QRadar, Datadog) with 7-year retention
• Right-to-deletion API for user data (GDPR Art. 17, PDPL Art. 18)
• Right-to-audit clauses in master agreement
• Breach notification within 72h (GDPR Art. 33)
• Zero-knowledge mode: vendor never sees plaintext prompts or completions
• Data Processing Agreement (DPA) with EU SCCs available as click-through
• SOC 2 Type II report available under NDA
• ISO 27001 / 27017 / 27018 certification current
• HIPAA attestation + BAA available
• FedRAMP Moderate (or higher) authorization for US federal workloads
• PDPL (Saudi), DIFC DPL, NSD compliance documented
• Per-tenant logical isolation in the data plane
• Customer-controlled data retention policy (auto-delete after N days)
• No training on customer data (model training opt-out)
• Cross-region replication disabled by default and customer-togglable