Where does your data live?

"Where are your servers?" is a question I get asked maybe twice a year, always by somebody in a regulated industry, and it is one of the few questions in this trade where the answer has to be a place rather than a brand. I answer it with a building in Białystok, which is either reassuring or irrelevant depending entirely on what you do for a living.

The reason it is a real question and not a marketing one is that data does not exist in the cloud. It exists on a specific drive, in a specific rack, in a specific building, in a specific country, under that country's law. Everything else is an abstraction laid over that fact, and abstractions are wonderful right up until somebody with legal authority reaches underneath one.

Two separate questions people merge into one

The first is where the data physically sits. The second is which legal system can compel the company holding it. These are not the same question and confusing them produces most of the bad reasoning in this area.

A provider can store your files in a data centre inside the European Union and still be a company incorporated elsewhere, subject to demands from a government elsewhere, some of which arrive with an obligation not to tell you about them. Location of the disk is a fact about geography. Jurisdiction is a fact about corporate structure, and it is the one that decides who can ask for what.

This is not a hypothetical concern invented by people selling hardware. It has been litigated repeatedly in Europe, the arrangements governing transfers of personal data across the Atlantic have been struck down more than once, and each replacement framework has faced the same fundamental objection. I am not going to attempt a legal summary — the ground moves and I am an engineer, not a lawyer — but the recurring pattern is worth knowing: the question keeps being asked because it keeps not being settled.

Who this genuinely matters for

Let me narrow it honestly, because the temptation in an article like this is to imply everybody should be worried and that would be nonsense.

It matters if you hold other people's personal data under a professional obligation: a medical or dental practice, a law office, an accountant, a psychologist, anyone processing health or biometric information. Those obligations are not satisfied by a supplier's assurance; they attach to you, and you are the one who has to be able to say where the data is and who may reach it.

It matters if you do work under a confidentiality agreement strict enough that your client would object to a third party holding the material — engineering under contract, anything defence-adjacent, research before publication.

It does not meaningfully matter for a joinery workshop's invoices or a family's holiday photographs, and I will say so to a client rather than sell them a concern they do not have. The honest version of this argument is narrow, and narrowing it is what makes it credible when it does apply.

What a server in your own building actually settles

It settles both questions at once, which is its main virtue and the reason it is a clean answer to a regulator's enquiry. The disk is in a room you can point at. The only party who can be compelled to produce the data is you, through a process you participate in and therefore know about.

What it does not settle is the rest of your obligations, and this is where I see people go wrong. Putting a server in your office does not make you compliant with anything by itself. You still need to control who has access, keep records of that access, secure the room, encrypt the drives against physical theft, and — the one everybody forgets — make sure the backup copy is under the same regime as the original. A perfectly local server backed up to an account in another jurisdiction has simply moved the question rather than answering it.

It also introduces a risk the provider was carrying for you: physical loss. A building can flood, burn or be burgled, and a regulated practice that loses its only copy of patient records has a far more immediate problem than any jurisdictional one. Sovereignty and durability are separate properties and you need both, which usually means a second copy somewhere that is still inside the boundary you chose.

The question worth asking instead

Not "is the cloud safe" — that question has no answer because it is not one thing. Ask this instead, about each category of data you hold: if somebody with legal authority wanted this, who would they ask, and would I find out?

That question is answerable, it takes five minutes per category, and the answers sort themselves into obvious piles. Most things land in the pile where it does not matter. A few land in the pile where it does, and those are the ones worth moving. That is the whole method, and it is considerably more useful than a general position on cloud computing.

I keep the machines I run in one country, under one legal system, in a room I have keys to. Not because I distrust the alternatives on principle — I use them daily for things where the question does not arise. Because for the categories where somebody might one day have to ask me where the data is, I want the answer to be a place I can walk to.