Where Your Data and Your Support Actually Live
Key Takeaways
Introduction
We get this question in almost every onboarding with a regulated organization. A large health system, a utility, or a bank will stop the conversation and ask: where does our data live?
It’s a good question, and it deserves a direct answer. Here’s ours, and the reasoning behind it.
Where does Derive store client data?
The short answer: the United States. Every system Derive Technologies uses to store sensitive client data keeps it in the United States. That data sits in one of two places:
- Infrastructure Derive owns, manages, and operates, or
- Leading cloud platforms, in US regions you choose
Take something as basic as a saved file. It lives in the cloud and is replicated across multiple zones for resilience, and those zones stay inside the United States. The data does not replicate overseas.
For US government and public sector clients, we go a step further and use cloud services built for stricter compliance requirements.
We didn’t invent any of this. Cloud providers publish detailed documentation on how they store, protect, and encrypt customer data, both at rest and in transit. When a client’s security team wants proof, we can point them to the source.
Does all sensitive data get the same protection?
Yes. Protected health information doesn’t get a lower bar than financial records, and a utility’s restricted security data doesn’t get a lower bar than either. We apply the same protection to all of it. The same goes for backup: the process we use to secure and back up our own data is the process we use for our clients’ data.
Why does US data residency matter beyond breach risk?
Most people assume the case for US-based data is about breach risk. That’s part of it. The bigger issue is legal recourse.
If your data is compromised on US soil, there’s a legal system that can act on it. Subpoenas can be enforced, investigations can go forward, and law enforcement can cooperate.
If your data or your support team sits in a country where US legal process has no reach, that recourse is gone. Subpoenas can’t be enforced, and if the trail leads there, there may be nobody to call.
In some jurisdictions, the government can also demand access to data held inside its borders. On a recent bid, the contract itself ruled out offshore. Public sector buyers go even further: for government agencies, including city agencies that serve children and families, it doesn’t matter how good the offshore offer is.
Is your support team part of your data footprint?
Data residency covers who can reach the servers as well as where they are.
Plenty of providers sell “follow-the-sun” support, with teams in different time zones handling tickets around the clock. That model can work in some countries. In others, it brings back the same jurisdictional risk you avoided by keeping your storage in the US.
Also remember that modern systems don’t just hold structured data, like the fields your team types into a CRM. They hold attachments too: PDFs, slide decks, spreadsheets, and scanned documents. Anyone with support access to the system can reach all of it.
Derive’s support team is based in the United States. We don’t route critical data through foreign entities or offshore support desks.
Is US-based support worth the higher cost?
US-based storage and support do cost more, and that cost is part of the service. In a competitive RFP, an offshore provider will often come in lower.
Regulated organizations still end up in the same place: the savings don’t matter if the model doesn’t meet the requirement. For a health system, a bank, or a government agency, where the data lives and who touches it are part of the compliance posture and can’t be traded away for price.
What should you ask any IT provider about data residency?
- Where exactly is our data stored, and does it ever replicate outside the US?
- What cloud platform do you use, and can you show us its published data residency and encryption documentation?
- Do you use a government cloud for public sector workloads?
- Where is your support team located, and who can access our systems and attachments?
- Is your backup process for our data the same as for your own?
- If something goes wrong, what legal jurisdiction applies?
If a provider can’t answer these clearly, that’s your answer.
Frequently Asked Questions
Where does Derive Technologies store client data?
In the United States. Sensitive client data sits either on infrastructure Derive owns and operates or in leading cloud platforms in US regions the client chooses, and it does not replicate overseas.
Why does data residency matter for regulated organizations?
Beyond breach risk, data on US soil keeps legal recourse available: subpoenas can be enforced, investigations can go forward, and law enforcement can cooperate. Some contracts and public sector buyers rule out offshore data entirely.
Is Derive’s support team based in the US?
Yes. Derive’s support team is based in the United States, and Derive does not route critical data through foreign entities or offshore support desks.
The Takeaway for IT Buyers
Want to know exactly where your data lives today? Start a conversation with Derive Technologies.