Core System Architecture Part 103 — Anonymous Network Data Residency, Sovereignty, Regional Placement, Cross-Border Transfer, Jurisdiction Policy & Privacy-Preserving Geographic Governance Architecture
SIAR — Secure, Local-First, Multi-Transport Communication Platform
Series: Core System Architecture
Part: 103
Status: Architecture specification
Primary language: Rust
Builds on: Core System Architecture Parts 33, 50, 55–61, 67–70, 74, 78–83, 94–102
Primary purpose: define SIAR's geographic-governance architecture for data residency, data sovereignty, regional placement, jurisdiction policy, cross-border transfer, tenant residency constraints, cryptographic locality, backup and disaster-recovery geography, federation boundaries, lawful-policy overlays, migration, exit, evidence, and privacy-preserving location-aware enforcement without creating precise user-location tracking.
1. Purpose
Geographic governance answers questions such as:
Where may this data be stored?
Where may it be processed?
Which region may hold backups?
Can a federation peer receive it?
What happens when regions or laws conflict?
How do we prove placement without tracking users?
The governing principle is:
SIAR geographic policy should constrain infrastructure placement and data movement using explicit data and jurisdiction classes, while avoiding collection of precise user location unless the product function itself requires it.
2. Architectural Position
Data / Operation
│
▼
Data Classification
│
▼
Residency / Sovereignty Policy
│
▼
Jurisdiction Resolution
│
▼
Placement / Transfer Decision
│
┌──┼───────────────┐
│ │ │
ALLOW RESTRICT DENY
│ │ │
└──┼───────────────┘
▼
Execution + Evidence
3. Core Separation
Keep distinct:
physical storage region
processing region
backup region
jurisdiction
tenant policy
user preference
legal restriction
federation boundary
4. Non-Goals
Part 103 does not create:
precise user-location tracking
IP-history profiling
automatic legal interpretation
global replication of sensitive data
residency policy based on guessed nationality
5. Geographic Concepts
#![allow(unused)] fn main() { pub struct RegionId(pub String); pub struct JurisdictionId(pub String); pub struct ResidencyPolicyId(pub [u8; 16]); }
6. Region
Infrastructure placement unit.
Examples:
provider region
organization datacenter zone
sovereign cloud region
7. Jurisdiction
Legal/policy boundary.
8. Hard Rule
Region and jurisdiction are not assumed identical.
9. Region Descriptor
#![allow(unused)] fn main() { pub struct RegionDescriptor { pub id: RegionId, pub jurisdiction: JurisdictionId, pub provider: ProviderId, pub capabilities: RegionCapabilities, } }
10. Region Capabilities
#![allow(unused)] fn main() { pub struct RegionCapabilities { pub storage: bool, pub processing: bool, pub backup: bool, pub hsm: bool, pub anonymous_relay: bool, } }
11. No User Location
Region descriptors describe infrastructure only.
12. Hard rule.
13. Geographic Data Classes
#![allow(unused)] fn main() { pub enum GeographicDataClass { LocalDeviceOnly, PersonalEncrypted, TenantManaged, Public, Infrastructure, AuditEvidence, SecurityEvidence, Governance, } }
14. LocalDeviceOnly
Must not leave device unless explicit operation permits.
15. PersonalEncrypted
May sync only under user/account policy.
16. TenantManaged
Organization residency applies.
17. Public
Intentionally public content.
18. Infrastructure
Service state.
19. AuditEvidence
Scoped audit data.
20. SecurityEvidence
Incident/security evidence.
21. Governance
Trust/policy state.
22. Hard Rule
Geographic policy begins with data class, not user identity.
23. Placement Purpose
#![allow(unused)] fn main() { pub enum PlacementPurpose { PrimaryStorage, Processing, Cache, Backup, DisasterRecovery, SearchIndex, AnalyticsAggregate, Audit, } }
24. Different purposes may have different region rules.
25. Hard rule.
26. Residency Constraint
#![allow(unused)] fn main() { pub enum ResidencyConstraint { AnyApprovedRegion, JurisdictionOnly(JurisdictionId), RegionOnly(RegionId), RegionSet(BTreeSet<RegionId>), LocalDeviceOnly, Prohibited, } }
27. No Free-Form Geographic String In Core Policy
Hard rule.
28. Processing Constraint
Storage and processing are separate.
29. Example
Data may be stored in one jurisdiction but processing elsewhere may be forbidden.
30. Hard rule.
31. Residency Policy
#![allow(unused)] fn main() { pub struct ResidencyPolicy { pub id: ResidencyPolicyId, pub data_class: GeographicDataClass, pub storage: ResidencyConstraint, pub processing: ResidencyConstraint, pub backup: ResidencyConstraint, pub transfer: CrossBorderPolicy, } }
32. Cross-Border Policy
#![allow(unused)] fn main() { pub enum CrossBorderPolicy { Deny, AllowApprovedDestinations(BTreeSet<JurisdictionId>), AllowWithTransferBasis(TransferBasisPolicy), PublicDataOnly, } }
33. Default Sensitive Policy
Prefer deny unless destination explicitly permitted.
34. Hard rule.
35. Policy Sources
Potential sources:
hard privacy invariant
governance policy
tenant managed policy
contractual residency
legal/compliance policy
user-selected storage preference
36. Policy Precedence
Recommended:
hard security/privacy invariant
> mandatory legal/residency restriction
> governance safety floor
> tenant managed restriction
> user restriction
> operational preference
> cost optimization
37. Most Restrictive Wins
When constraints can be intersected.
38. Hard rule.
39. Unsatisfiable Policy
If no region satisfies all constraints:
do not silently broaden placement
40. Decision:
#![allow(unused)] fn main() { pub enum PlacementDecision { Allowed(RegionId), Deferred, Denied(PlacementDenialReason), } }
41. Hard Rule
Availability/cost cannot silently override unsatisfied residency policy.
42. Placement Denial Reasons
#![allow(unused)] fn main() { pub enum PlacementDenialReason { NoApprovedRegion, ResidencyConflict, ProcessingForbidden, BackupForbidden, JurisdictionConflict, SecurityCapabilityMissing, } }
43. Region Catalog
Signed and versioned.
44. Contains:
region ID
provider
jurisdiction
approved services
security capabilities
residency classifications
45. No user records.
46. Hard rule.
47. Region Approval State
#![allow(unused)] fn main() { pub enum RegionApprovalState { Approved, Restricted, Deprecated, Prohibited, } }
48. Deprecated
No new placement, migration planned.
49. Prohibited
No placement/processing.
50. Hard rule.
51. Geographic Policy Compiler
Compiles policy into placement constraints.
52. Output:
#![allow(unused)] fn main() { pub struct CompiledPlacementPolicy { pub allowed_storage_regions: BTreeSet<RegionId>, pub allowed_processing_regions: BTreeSet<RegionId>, pub allowed_backup_regions: BTreeSet<RegionId>, } }
53. Empty Set Means Deny
Hard rule.
54. No "fallback to global."
55. Placement Engine
#![allow(unused)] fn main() { pub trait GeographicPlacementEngine { fn decide( &self, request: &PlacementRequest, policy: &CompiledPlacementPolicy, ) -> Result<PlacementDecision, GeographicGovernanceError>; } }
56. Placement Request
#![allow(unused)] fn main() { pub struct PlacementRequest { pub data_class: GeographicDataClass, pub purpose: PlacementPurpose, pub scope: DataScope, pub required_capabilities: BTreeSet<RegionCapability>, } }
57. Data Scope
#![allow(unused)] fn main() { pub enum DataScope { Personal, Tenant(TenantId), Service(ServiceId), FederationPeer(FederationDomainId), Governance, } }
58. No Precise User Geography
Hard rule.
59. User Location vs Residency
Important distinction.
60. Residency should usually derive from:
tenant contract
selected account region
deployment configuration
legal policy
not:
real-time GPS
continuous IP geolocation
61. Hard rule.
62. Account Region Selection
If personal cloud sync exists.
63. User can choose from approved coarse regions.
64. Choice stored as policy.
65. Not inferred continuously.
66. Hard rule.
67. Tenant Residency
Organization chooses approved region/jurisdiction policy.
68. Tenant Residency Policy
#![allow(unused)] fn main() { pub struct TenantResidencyPolicy { pub tenant: TenantId, pub primary: ResidencyConstraint, pub backup: ResidencyConstraint, pub processing: ResidencyConstraint, } }
69. Tenant A does not affect B.
70. Hard rule.
71. Managed vs Personal
Tenant policy applies only managed data/profile.
72. Cannot govern personal data outside managed scope.
73. Hard rule.
74. Local-First Architecture Benefit
Personal data may remain on device.
75. Reduced cross-border movement.
76. Good.
77. Device-Local Data
No central residency issue until sync/export.
78. At sync time
destination policy evaluated.
79. Hard rule.
80. Storage Placement
Database/object storage must use allowed region.
81. Service deployment does not imply data may be stored there.
82. Hard rule.
83. Processing Locality
A service processing sensitive data must execute in allowed processing region.
84. No remote processor outside policy.
85. Hard rule.
86. Cache Locality
Caches can leak data.
87. Cache placement uses same or stricter policy than source.
88. Hard rule.
89. Search Index Locality
Private search index:
local device
by baseline.
90. Managed/server indexes inherit source residency.
91. No global search index for private data.
92. Hard rule.
93. Analytics Locality
Aggregate analytics may have separate policy.
94. But raw private events are already forbidden.
95. Part 92 applies.
96. Hard rule.
97. Audit Locality
Tenant audit remains tenant-approved regions.
98. Governance/public transparency may be globally replicated if public.
99. Hard rule.
100. Security Evidence Locality
Incident evidence is highly sensitive.
101. Evidence collection plan includes region/jurisdiction.
102. No external forensic SaaS upload by default.
103. Hard rule.
104. Backup Residency
Backup is a copy and must obey explicit residency.
105. No assumption backup region is exempt.
106. Hard rule.
107. Backup Placement Decision
Separate from primary.
108. Example:
primary: region A
backup: regions A+B within same jurisdiction
109. Good.
110. Disaster Recovery Geography
Part 100.
111. Failover target must satisfy:
residency
processing
privacy
security
capacity
112. No cross-border DR bypass.
113. Hard rule.
114. DR Unsatisfied
If compliant failover unavailable:
read-only
local-only
queued
unavailable
115. not policy violation.
116. Hard rule.
117. Multi-Region Replication
Only among allowed regions.
118. Replication topology validated.
119. No accidental global DB replication.
120. Hard rule.
121. Data Replica Descriptor
#![allow(unused)] fn main() { pub struct ReplicaPlacement { pub replica_id: ReplicaId, pub region: RegionId, pub role: ReplicaRole, pub data_class: GeographicDataClass, } }
122. Replica Audit
Placement state is inventory/evidence.
123. No user activity.
124. Hard rule.
125. Cross-Border Transfer
Explicit operation.
126. Transfer Request
#![allow(unused)] fn main() { pub struct CrossBorderTransferRequest { pub data_class: GeographicDataClass, pub source: JurisdictionId, pub destination: JurisdictionId, pub purpose: TransferPurpose, pub scope: DataScope, } }
127. Transfer Purpose
#![allow(unused)] fn main() { pub enum TransferPurpose { ServiceProcessing, Backup, Federation, SupportExport, UserExport, SecurityResponse, } }
128. No generic Other.
Preferred hard rule.
129. Transfer Decision
#![allow(unused)] fn main() { pub enum TransferDecision { Allow, AllowWithControls(Vec<TransferControl>), Deny, } }
130. Transfer Controls
Examples:
encryption
approved processor
short retention
contractual/legal basis
manual approval
131. Encryption Alone Does Not Automatically Make Transfer Lawful
Hard truth.
132. Legal Basis Boundary
Architecture represents approved policy decisions.
133. It does not autonomously practice law.
134. Hard rule.
135. Transfer Basis
#![allow(unused)] fn main() { pub enum TransferBasisPolicy { Contractual, ExplicitConsentWhereApplicable, LegalRequirement, ApprovedOrganizationPolicy, } }
136. Exact legal interpretation belongs outside core.
137. Hard rule.
138. Cross-Border Transfer Receipt
#![allow(unused)] fn main() { pub struct TransferReceipt { pub transfer_id: TransferId, pub source: JurisdictionId, pub destination: JurisdictionId, pub policy_version: JurisdictionPolicyVersion, pub decision_digest: Digest, } }
139. Receipt records decision, not content.
140. Hard rule.
141. Transfer Data Plane
Execution enforces decision.
142. Control plane decision alone insufficient.
143. Destination service revalidates.
144. Hard rule.
145. Egress Gateway Policy
Regional egress gateways can enforce allowed destinations.
146. No universal proxy that sees plaintext.
147. Hard rule.
148. Service-to-Service Transfer
Part 79 identities.
149. Request context includes residency policy token/reference.
150. No user location.
151. Hard rule.
152. Residency Capability
#![allow(unused)] fn main() { pub struct ResidencyCapability { pub scope: DataScope, pub allowed_regions: BTreeSet<RegionId>, pub purposes: BTreeSet<PlacementPurpose>, pub expires_at: Timestamp, } }
153. Attenuated.
154. Cannot broaden itself.
155. Hard rule.
156. Cryptographic Locality
Keys can enforce geography indirectly.
157. Example:
region-specific KEK/HSM
158. Data encrypted with key unavailable outside allowed region.
159. Strong defense.
160. Hard rule.
161. Regional Key Domain
#![allow(unused)] fn main() { pub struct RegionalKeyDomain { pub region: RegionId, pub jurisdiction: JurisdictionId, pub key_class: KeyClass, } }
162. Cross-region decrypt requires explicit policy.
163. No global decrypt-anywhere key.
164. Hard rule.
165. Tenant Regional Keys
Tenant-managed data can use region/tenant scoped keys.
166. Strong isolation.
167. Hard rule.
168. HSM Placement
HSM/key service location obeys policy.
169. Remote HSM call can itself be cross-border processing.
170. Hard rule.
171. Key Backup Geography
Key backups/shares have separate policy.
172. No hidden offshore key escrow.
173. Hard rule.
174. Federation Geography
Federation is a cross-domain transfer boundary.
175. Each domain declares jurisdiction metadata.
176. Local domain evaluates before transfer.
177. No transitive permission.
178. Hard rule.
179. Federation Domain Descriptor
#![allow(unused)] fn main() { pub struct FederationGeographicDescriptor { pub domain: FederationDomainId, pub jurisdictions: BTreeSet<JurisdictionId>, pub processing_regions: BTreeSet<RegionId>, pub policy_digest: Digest, } }
180. Signed by domain.
181. Locally verified.
182. Hard rule.
183. Remote Claims Are Not Automatically Trusted
Use federation trust policy.
184. Hard rule.
185. Federation Transfer
Public content
may be broad.
186. Private/tenant data
requires explicit capability and residency compatibility.
187. Hard rule.
188. Anonymous Communication Geography
Anonymity complicates jurisdiction.
189. Route may traverse multiple jurisdictions.
190. Policy must distinguish:
content storage
content processing
packet transit
relay transit
191. Hard rule.
192. Transit Jurisdiction Policy
#![allow(unused)] fn main() { pub enum TransitConstraint { AnyApprovedRelay, JurisdictionSet(BTreeSet<JurisdictionId>), RegionSet(BTreeSet<RegionId>), } }
193. Strict transit restrictions reduce anonymity/path diversity.
194. Architecture must expose tradeoff truthfully.
195. Hard rule.
196. No Impossible Guarantee
Do not claim precise internet transit jurisdiction if underlying network cannot enforce it.
197. Hard truth.
198. Mixnet Route Policy
Can select nodes from allowed jurisdiction classes if policy requires.
199. But may reduce anonymity set.
200. User/tenant informed.
201. Hard rule.
202. Relay Residency
Relay seeing ciphertext is still infrastructure processing/transit.
203. Policy classification explicit.
204. Hard rule.
205. Public Relay Directory
Can include coarse jurisdiction/region claims.
206. No operator private location.
207. Hard rule.
208. Mailbox Residency
Encrypted mailbox provider location can be selected.
209. Mailbox ciphertext still subject to policy if configured.
210. Hard rule.
211. Personal Node
User-hosted node region policy determined by user deployment.
212. Platform should not guess exact physical location.
213. Hard rule.
214. Data Sovereignty
Sovereignty broader than storage geography.
215. It may include:
operator control
key custody
processor jurisdiction
administrative authority
216. Hard rule.
217. Sovereignty Profile
#![allow(unused)] fn main() { pub struct SovereigntyProfile { pub allowed_operators: BTreeSet<OperatorClass>, pub required_key_custody: KeyCustodyPolicy, pub residency: ResidencyPolicyId, } }
218. Operator Class
Examples:
first-party
tenant-controlled
approved sovereign provider
219. No user demographic classification.
220. Hard rule.
221. Sovereign Deployment
Possible topology:
tenant-controlled servers
tenant HSM
tenant region
no external processor
222. Useful enterprise/government mode.
223. Must remain interoperable via federation/capability boundaries.
224. Hard rule.
225. Provider Jurisdiction Risk
Provider legal domicile may matter separately from region.
226. Region descriptor can include:
provider jurisdiction
physical region jurisdiction
operator class
227. Policy decides.
228. No hardcoded legal conclusion.
229. Hard rule.
230. Jurisdiction Policy
#![allow(unused)] fn main() { pub struct JurisdictionPolicy { pub version: JurisdictionPolicyVersion, pub allowed_regions: BTreeSet<RegionId>, pub prohibited_jurisdictions: BTreeSet<JurisdictionId>, pub transfer_rules: Vec<TransferRule>, } }
231. Signed/versioned.
232. Anti-rollback.
233. Hard rule.
234. Policy Change
Can require migration.
235. Example:
region becomes prohibited.
236. New writes stop immediately if required.
237. Existing data migration scheduled.
238. Hard rule.
239. Policy Transition State
#![allow(unused)] fn main() { pub enum GeographicPolicyTransition { Stable, RestrictingNewPlacement, Migrating, Verifying, Complete, Failed, } }
240. No instant magical compliance claim.
241. Hard rule.
242. Data Migration
Cross-region movement itself is transfer.
243. Must be authorized.
244. Encrypt in transit.
245. Verify destination.
246. Delete source after verification if policy requires.
247. Hard rule.
248. Migration State
#![allow(unused)] fn main() { pub enum RegionalMigrationState { Planned, Copying, Validating, Cutover, SourceDeleting, Completed, Failed, } }
249. No source deletion before destination validation.
250. Hard rule.
251. Source Deletion
Must include:
DB rows
object blobs
indexes
caches
backups per retention
keys
252. No "primary moved" while replicas remain prohibited.
253. Hard rule.
254. Cryptographic Erasure
Can accelerate source-region exit where applicable.
255. Destroy regional data keys after verified migration/retention policy.
256. Hard rule.
257. Migration Receipt
#![allow(unused)] fn main() { pub struct RegionalMigrationReceipt { pub migration: MigrationId, pub source: RegionId, pub destination: RegionId, pub data_class: GeographicDataClass, pub verification_digest: Digest, } }
258. No content.
259. Hard rule.
260. Tenant Region Change
Admin-controlled managed operation.
261. Requires explicit approval.
262. Show impact:
downtime
backup migration
federation changes
key rotation
263. Hard rule.
264. Personal Account Region Change
User-requested.
265. No hidden migration.
266. Local-first data remains local unless sync copy moved.
267. Hard rule.
268. Region Exit
When provider/region deprecated.
269. Need:
inventory
migration
verification
source erasure
key retirement
270. Hard rule.
271. Vendor Exit
Provider portability.
272. Use standard data formats and encrypted object export.
273. No provider-specific hidden lock-in.
274. Hard rule.
275. Cross-Border Support Access
Support personnel may be in another jurisdiction.
276. Access itself may be regulated.
277. Prefer support tools that expose minimized data.
278. No raw private content by default.
279. Hard rule.
280. Support Access Policy
#![allow(unused)] fn main() { pub struct SupportAccessPolicy { pub allowed_jurisdictions: BTreeSet<JurisdictionId>, pub allowed_data_classes: BTreeSet<GeographicDataClass>, pub expires_at: Option<Timestamp>, } }
281. Time-limited elevation.
282. Audited.
283. Hard rule.
284. Incident Response Geography
Part 96.
285. Incident does not automatically override residency.
286. Sensitive evidence transfer needs approved incident/legal policy.
287. Hard rule.
288. Emergency Exception
Possible if governance/legal policy explicitly permits.
289. Time-bound.
290. Scoped.
291. Audited.
292. Never privacy-floor bypass.
293. Hard rule.
294. Jurisdiction Conflict
Two requirements may conflict.
295. Example:
tenant requires Region A
security control requires HSM unavailable in A
296. Result
deny/defer/escalate.
297. Never silently choose one.
298. Hard rule.
299. Conflict Record
#![allow(unused)] fn main() { pub struct GeographicPolicyConflict { pub scope: DataScope, pub requirements: Vec<PolicyRequirementRef>, pub resolution: Option<ConflictResolution>, } }
300. Resolution
Explicit approval/policy change.
301. No runtime guessing.
302. Hard rule.
303. Data Classification Integration
Part 42/56/67.
304. Data class controls geography.
305. Unknown data class
deny external placement by default.
306. Hard rule.
307. Database Integration
Part 74.
308. Tenant rows/partitions map to allowed region.
309. No cross-region read replica outside policy.
310. Hard rule.
311. Object Storage Integration
Object metadata carries placement class.
312. Storage provider bucket policy enforces.
313. Encryption key domain reinforces.
314. Hard rule.
315. Queue/Event Integration
Events can themselves contain sensitive data.
316. Queue placement inherits event data class.
317. Cross-region bus replication restricted.
318. Hard rule.
319. Logs/Telemetry Geography
Logs can contain sensitive metadata.
320. Telemetry storage policy applies.
321. No centralized global log sink by default.
322. Hard rule.
323. Analytics Geography
Only approved aggregate data may cross.
324. Raw user analytics already forbidden.
325. Hard rule.
326. AI Processing Geography
If remote AI ever used:
processing region
provider
retention
data class
must satisfy policy.
327. On-device preferred for sensitive use.
328. No silent external API transfer.
329. Hard rule.
330. Email/Notification Providers
External providers can create transfers.
331. Keep payload minimal.
332. Region/provider policy applies.
333. Hard rule.
334. Push Providers
Push hints opaque.
335. Provider receives no private body.
336. Geographic policy may restrict use by managed tenant.
337. Hard rule.
338. Payment/Billing Providers
Separate domain.
339. Financial records may have own residency.
340. Do not join with private communication data.
341. Hard rule.
342. Search Federation Geography
Public/federated search only across allowed domains.
343. Private search remains local.
344. Hard rule.
345. Content Federation Geography
Public content may intentionally cross.
346. Private/group content requires explicit federation capability and policy.
347. Hard rule.
348. User Export
User export can leave platform.
349. User explicitly controls destination.
350. Platform warns when leaving managed/residency boundary if relevant.
351. Hard rule.
352. Tenant Export
Admin capability required.
353. Destination/transfer policy checked.
354. Signed export manifest.
355. Hard rule.
356. Data Import
Imported data receives classification/residency before activation.
357. No unclassified placement.
358. Hard rule.
359. Residency Evidence
Need prove policy enforcement.
360. Evidence can include:
region inventory
provider resource IDs
deployment manifest
key-domain metadata
storage configuration
backup placement
361. No user content.
362. Hard rule.
363. Residency Evidence Object
#![allow(unused)] fn main() { pub struct ResidencyEvidence { pub scope: DataScope, pub purpose: PlacementPurpose, pub region: RegionId, pub policy_version: JurisdictionPolicyVersion, pub digest: Digest, } }
364. Evidence signed/attested where required.
365. Hard rule.
366. Compliance Integration
Part 95.
367. Controls:
approved primary region
approved backup region
regional key custody
cross-border gate
source-region deletion after migration
368. Unknown evidence ≠ compliant.
369. Hard rule.
370. Audit Integration
Part 94.
371. Audit high-risk actions:
residency policy change
region migration
cross-border exception
tenant region change
region prohibition
372. Not every request routed.
373. Hard rule.
374. DR Integration
Part 100.
375. Failover target residency checked.
376. Backups respect geography.
377. Hard rule.
378. Capacity Integration
Part 101.
379. Capacity shortage cannot force forbidden region.
380. May degrade service instead.
381. Hard rule.
382. FinOps Integration
Part 102.
383. Cheaper region considered only after residency/security/privacy filter.
384. No cost override.
385. Hard rule.
386. Deployment Integration
Part 62.
387. Deployment controller only schedules data-processing workloads in allowed region.
388. Hard rule.
389. Service Discovery Integration
Part 77.
390. Resolver filters endpoints by placement policy.
391. No accidental cross-region selection.
392. Hard rule.
393. Edge Gateway Integration
Ingress region may differ from processing region.
394. Edge must not persist sensitive payload outside policy.
395. Hard rule.
396. East-West Integration
Residency context propagated minimally.
397. No user precise location.
398. Hard rule.
399. Secrets Integration
Part 80.
400. Secret brokers region-scoped.
401. Dynamic credentials not replicated globally.
402. Hard rule.
403. HSM Integration
Part 72.
404. Regional/tenant key custody supports sovereignty.
405. Hard rule.
406. Update Integration
Part 99.
407. Update artifacts public and globally cacheable.
408. Managed metadata may remain regional.
409. Hard rule.
410. SOC Integration
Part 97.
411. Threat intelligence can be shared globally if non-sensitive/public.
412. Local evidence remains scoped.
413. Hard rule.
414. Vulnerability Integration
Part 98.
415. Patch artifact distribution not confused with private data transfer.
416. Hard rule.
417. Geographic Policy API
#![allow(unused)] fn main() { pub trait GeographicPolicyService { fn compile( &self, scope: DataScope, data_class: GeographicDataClass, ) -> Result<CompiledPlacementPolicy, GeographicGovernanceError>; fn authorize_transfer( &self, request: &CrossBorderTransferRequest, ) -> Result<TransferDecision, GeographicGovernanceError>; } }
418. Region Catalog API
#![allow(unused)] fn main() { pub trait RegionCatalog { fn region( &self, id: &RegionId, ) -> Result<RegionDescriptor, GeographicGovernanceError>; fn approved_regions( &self, ) -> Result<Vec<RegionDescriptor>, GeographicGovernanceError>; } }
419. Migration Orchestrator
#![allow(unused)] fn main() { pub trait RegionalMigrationOrchestrator { fn plan( &self, source: RegionId, destination: RegionId, scope: DataScope, ) -> Result<RegionalMigrationPlan, GeographicGovernanceError>; } }
420. No implicit execution.
421. Hard rule.
422. Geographic Governance Errors
#![allow(unused)] fn main() { pub enum GeographicGovernanceError { UnknownRegion, RegionProhibited, JurisdictionProhibited, UnsatisfiablePolicy, TransferDenied, ResidencyViolation, ProcessingViolation, BackupPlacementViolation, PolicyConflict, MigrationFailed, EvidenceInvalid, Unauthorized, Internal, } }
423. Policy Observability
Safe metrics:
placements by region
denied placement count
migration status
policy conflict count
424. Forbidden:
user movement history
IP geolocation history
precise device location
425. Hard rule.
426. Geographic Governance SLOs
Examples:
placement-policy evaluation latency
region-catalog freshness
migration completion
forbidden-placement detection
427. Privacy SLO
0 precise user location collected for residency enforcement
0 IP-history retention for geographic policy
0 cross-border transfer outside policy
428. Security SLO
0 prohibited region storage
0 cross-region decrypt outside key policy
0 DR failover into forbidden region
429. Failure Modes
region outage
jurisdiction policy change
provider metadata mismatch
capacity unavailable
migration failure
430. Region Outage
Use compliant DR target only.
431. No forbidden fallback.
432. Hard rule.
433. Jurisdiction Policy Change
Stop new prohibited placement.
434. Evaluate migration.
435. No silent historical compliance claim.
436. Hard rule.
437. Provider Metadata Mismatch
Treat region classification Unknown.
438. Sensitive placement denied until resolved.
439. Hard rule.
440. Capacity Unavailable
Degrade/queue.
441. Do not spill into cheap/global region.
442. Hard rule.
443. Migration Failure
Keep source authoritative if allowed and safe.
444. Do not delete source.
445. Hard rule.
446. Policy Testing
Need geographic-governance testkit.
447. Test Scenarios
tenant single-region policy
cross-border backup denial
regional failover
provider exit
policy conflict
448. Storage Test
Disallowed region rejected.
449. Processing Test
Allowed storage but forbidden processing rejected.
450. Backup Test
Backup outside policy rejected.
451. DR Test
Cheaper forbidden failover target rejected.
452. Tenant Isolation Test
Tenant A policy cannot affect B.
453. Managed/Personal Test
Tenant residency does not capture personal data.
454. User Location Test
No GPS/IP history needed.
455. Migration Test
Source deleted only after destination verification.
456. Replica Test
No prohibited replica remains.
457. Key Locality Test
Cross-region decrypt rejected.
458. Federation Test
Remote jurisdiction claim locally verified.
459. Transit Test
Strict relay-jurisdiction policy enforced where technically possible.
460. Impossibility Test
System does not claim unenforceable internet transit guarantee.
461. Policy Rollback Test
Old permissive jurisdiction policy rejected.
462. Backup Restore Test
Old backup cannot reintroduce prohibited region policy.
463. Cost Test
Cheapest region not selected if policy fails.
464. Capacity Test
Overload cannot broaden geographic placement.
465. Fuzzing
Fuzz:
region descriptor
residency policy
transfer request
migration manifest
jurisdiction policy
466. Property Tests
Properties:
empty allowed-region intersection can never produce Allowed placement
cost or capacity pressure can never select a prohibited region
tenant-scoped residency rule can never govern unrelated personal data
cross-border transfer cannot execute without an Allow/AllowWithControls decision
467. Formal Verification Targets
Strong candidates:
policy intersection
placement decision
cross-border transfer gate
regional migration state machine
468. Kani Candidate
constraint precedence and deny invariants.
469. TLA+ Candidate
policy change → restrict writes → migrate → verify → source erase → complete.
470. Loom Candidate
concurrent policy update + placement request + failover selection.
471. Performance
Placement checks are frequent.
472. Compile policies ahead of time.
473. Use region bitsets/sets.
474. No network request on every data operation.
475. Hard rule.
476. Policy Cache
Short/versioned.
477. Invalidate on signed policy update.
478. No stale permissive cache after restriction.
479. Hard rule.
480. Storage
Separate stores:
region catalog
jurisdiction policies
tenant residency policies
compiled placement policies
migration state
residency evidence
481. No user geolocation warehouse.
482. Hard rule.
483. Partitioning
By:
tenant
service
region
jurisdiction
federation domain
484. Not by precise user location.
485. Hard rule.
486. Crate Layout
Recommended:
crates/
├── siar-geo-governance-core/
├── siar-region-catalog/
├── siar-jurisdiction-policy/
├── siar-residency-policy/
├── siar-placement-engine/
├── siar-transfer-gate/
├── siar-regional-key-policy/
├── siar-regional-migration/
├── siar-sovereignty/
├── siar-residency-evidence/
├── siar-geo-observability/
└── siar-geo-governance-testkit/
487. siar-geo-governance-core
Owns:
RegionId
JurisdictionId
data classes
purposes
errors
488. siar-region-catalog
Signed infrastructure region metadata.
489. siar-jurisdiction-policy
Signed legal/governance geographic constraints.
490. siar-residency-policy
User/tenant/service residency constraints.
491. siar-placement-engine
Policy intersection and region selection.
492. siar-transfer-gate
Cross-border transfer authorization.
493. siar-regional-key-policy
Regional cryptographic locality/key domains.
494. siar-regional-migration
Copy/validate/cutover/source-erasure orchestration.
495. siar-sovereignty
Operator/key-custody/sovereign deployment profiles.
496. siar-residency-evidence
Placement and migration assurance evidence.
497. siar-geo-observability
Aggregate geographic-policy health only.
498. siar-geo-governance-testkit
residency/transfer/DR/migration/privacy tests.
499. Security, Privacy & Correctness Invariants
Mandatory:
1. Geographic governance operates on data classes, infrastructure regions, jurisdictions, tenants, services, and federation domains—not continuous precise user location.
2. Storage, processing, backup, cache, analytics, audit, and disaster-recovery placement are separate purposes and are individually constrained.
3. Region and jurisdiction are distinct concepts; infrastructure metadata must explicitly map one to the other rather than assuming equivalence.
4. Conflicting policy constraints produce denial/defer/escalation, never silent expansion to a broader region or jurisdiction.
5. Capacity shortage, cost optimization, regional outage, autoscaling, or disaster recovery can never override a prohibited residency or cross-border-transfer constraint.
6. Tenant residency governs managed tenant data only and cannot extend into unrelated personal data, personal devices, or other tenants.
7. Cross-border transfers are explicit typed operations with source, destination, purpose, policy decision, and evidence; encryption alone is never treated as automatic authorization.
8. Backups, replicas, caches, indexes, logs, incident evidence, and key material obey residency constraints just like primary data.
9. Regional/tenant key domains can cryptographically reinforce locality, and no universal decrypt-anywhere key exists for sensitive data.
10. Federation peers provide signed geographic claims, but local policy independently decides whether data may be transferred; federation trust is not transitive geographic authorization.
11. Regional migration requires destination verification, cutover, source cleanup, backup/key review, and anti-resurrection controls before compliance is considered complete.
12. Geographic governance collects no GPS history, persistent IP-geolocation history, or behavioral location profile merely to enforce data residency.
500. Initial Production Scope
Implement first:
typed RegionId/JurisdictionId
signed region catalog
geographic data classes
storage/processing/backup residency constraints
tenant residency policy
compiled placement policy
placement engine
cross-border transfer gate
region-aware DB/object storage placement
backup/DR residency enforcement
regional key domains
federation geographic descriptors
regional migration state machine
residency evidence
audit/compliance integration
privacy-safe geographic metrics
geographic governance testkit
Then add:
advanced sovereignty profiles
tenant-controlled sovereign deployments
formal transfer-basis adapters
multi-provider region equivalence
privacy-preserving geographic attestations
formal policy-intersection/migration verification
501. Definition of Done
Part 103 is complete when:
- infrastructure regions and jurisdictions are typed separately
- all sensitive data has explicit geographic class/purpose
- storage, processing, backup, and DR constraints are independently enforceable
- tenant residency is isolated to managed tenant scope
- precise user location is not required
- cross-border transfer is explicit and gated
- key locality can reinforce policy
- federation does not bypass local transfer rules
- cost/capacity/DR cannot choose forbidden regions
- policy conflicts fail safely
- migrations verify destination before source erasure
- backups/replicas/indexes/logs obey residency
- audit/compliance evidence exists without user-location surveillance
- residency/transfer/migration/privacy/fuzz/formal tests are specified
502. Final Architecture
DATA / OPERATION
│
▼
DATA CLASSIFICATION
│
▼
RESIDENCY + SOVEREIGNTY
│
▼
JURISDICTION INTERSECTION
│
┌────────┼────────┐
│ │ │
ALLOW RESTRICT DENY
│ │ │
└────────┼────────┘
▼
REGIONAL PLACEMENT
│
▼
CRYPTOGRAPHIC ENFORCEMENT
│
▼
EVIDENCE / AUDIT
Geographic-governance safety model:
typed data classes
+
explicit region/jurisdiction policy
+
purpose-specific placement rules
+
cross-border transfer gates
+
regional key domains
+
tenant isolation
+
verified migration
+
privacy-safe evidence
not:
track where every user is, guess residency from IP, replicate data globally for convenience, and call encryption alone sufficient for every cross-border transfer
503. Final Principle
Data residency should constrain where systems place and process data—not require the system to continuously locate the people who use it.
The correct model is:
classify data
+
model jurisdictions explicitly
+
compile restrictive policy
+
place only in approved regions
+
gate every cross-border transfer
+
bind keys to locality where useful
+
migrate verifiably
+
never turn residency into location surveillance
This architecture gives SIAR a privacy-preserving geographic-governance foundation for regional storage, sovereign deployments, tenant residency, cross-border transfer, disaster recovery, federation, migration, key locality, and jurisdiction-aware operations while preserving the anonymity, local-first, least-authority, and anti-surveillance guarantees established across Parts 34–102.