Where is your SaaS customer data stored, and can you change the region?

Specify the data before specifying the country

A client may require customer records to stay in Japan, while another asks where support staff can access them. Those are different requirements. Data residency usually describes where covered data is stored at rest; it does not, by itself, describe every place where data is processed or accessed.

Write the requirement in terms of business records, attachments, account credentials, backups and AI processing. Include whether it applies to subcontractors. A region label in the administration screen is useful evidence, but it cannot answer all those questions on its own.

Scroll the table horizontally on a small screen.

Tokyo storage is not an all-Japan data flow

Asana's help lists teams, projects, tasks, exports and attachments as data stored in the chosen region. Authentication information, including email addresses and some credentials, and usage measurement data may be stored outside it. For Japan residency, AI feature requests are processed in the US; the regional AI processing arrangement described in the guide is currently for EU residency.

monday.com's guide also separates customer-uploaded data from credentials, profiles, usage analytics and automation metadata stored in the default US region. EU Standard and Pro data may be processed in the US, and the guide describes additional EU subprocessor coverage for Enterprise. Record the scope instead of answering “everything stays in the selected region.”

A foreign server does not settle the legal question

For a Japanese business, the Personal Information Protection Commission's Q12-3 distinguishes storage abroad from provision to a foreign third party. If the foreign cloud operator is contractually prevented from handling the personal data and appropriate access controls apply, the storage described in that FAQ is not a third-party provision under Article 28(1). The real service arrangement needs assessment; a country name alone is insufficient.

A data processing agreement documents responsibilities, but having one does not prove that every legal or client requirement is met. Likewise, an audit report does not replace evidence of storage and processing locations. If a client requests a particular report, ask for that report and its covered service rather than substituting a summary because it is easier to download.

Decide before the first import

If your requirement names a country, send the full data scope with the quote request. A business needing all processing in Japan cannot assume Asana's Tokyo option satisfies it. A monday.com buyer who expects to change regions should plan the new-account route before uploading records, including which settings and history can be transferred.

If no location requirement exists, record the current region and contract documents before paying for a migration. If one does exist, select the configuration only after the vendor confirms the covered data, exceptions, processing locations and move procedure. This article compares published product arrangements; a legal assessment depends on your data and contracts.

Sources checked 10 October 2026

HubSpot: locations and migration / monday.com: residency scope / Asana: regions, exceptions and AI processing / Shopify: international transfers / Japan PPC: Q12-3

Read this article in Japanese →

Preparing information-management documents for a client →

← Back to the comparison