Overview

Understand how deployment region, subprocessors, backups, and tenant configuration determine where customer data is processed.

Audience

• Admin
• It Security
• Compliance

Product Area

Trust

Prerequisites

• Tenant deployment profile or contract available

Steps

1. Check the deployment record

Use the executed order form, DPA, and tenant deployment profile as the authoritative record for approved regions and services.

1. Review data flows

Identify primary storage, backups, observability, email, integrations, and any AI provider processing enabled for the tenant.

1. Review changes before enabling services

Require privacy and security review when a new region, connector, provider, or subprocessor changes the approved data flow.

Expected Result

Administrators can identify the approved processing regions, enabled processors, transfer mechanism, backup treatment, and deletion commitments for their tenant.

Security and Audit Notes

• Use the least-privileged role that can complete the task.
• Confirm the resulting change or decision appears in the workspace audit trail when the workflow changes customer data or access.

Limits and Preconditions

• Residency is deployment-specific and must not be inferred from repository defaults.
• The public portal does not expose confidential tenant architecture or credentials.

Troubleshooting

• A generic architecture diagram is treated as the tenant contract: Use deployment-specific evidence and executed terms; diagrams describe patterns, not contractual configuration.

Related Articles

• Security Review Preparation Checklist
• Configure Retention Policy
• Procurement Due Diligence Checklist

Escalation

If the documented result cannot be reached after the checks above, capture the workspace identifier, affected product area, timestamp, and a redacted error message, then use Support. Never include secrets, privileged legal content, or customer documents in the initial report.