Security & Compliance · Data residency map
ResidencyMap
Know where your data lives.
See the country of every database, bucket, replica and backup, and which cross-border transfers need action under GDPR, RBI, CERT-In and Australian rules.
$ residency-map analyze state.json --subjects IN,EU,AU
8 data stores · United States 4 · India 2 · Singapore 1 · Germany 1
HIGH RS003 Indian payment data stored outside India (Singapore, US)
HIGH RS004 Logs kept outside India (Germany)
MEDIUM RS002 EU/UK personal data stored in the United States
MEDIUM RS008 Copy in another country: India → United States
The problem
Customers' contracts and regulators ask where their data is stored, including backups. Replicas and backup copies quietly move data to other countries.
What it does
Maps every data store in Terraform (AWS, Azure, Google Cloud) to a country
Finds hidden copies: S3 replication, DynamoDB global tables, RDS replicas, AWS Backup copies, Azure geo-redundancy
EU/UK: flags personal data outside the EEA/UK and US transfers that need DPF or SCCs
India: RBI payment data and CERT-In logs that must stay in India
Australia: APP 8 offshore disclosures and health data that must stay onshore
Transfer register CSV with a column for your legal basis
Record of processing activities (Art. 30) pre-filled from your infrastructure
How it works
- Export Terraform with terraform show -json
- Choose whose personal data you hold, or tag stores with data_subjects
- Fix the flagged transfers and file the register
Works with
Your data
- Reads configuration, never data.
- Read-only access.
- Results stay with you.
Who it's for
Questions
Why include backups?
Backups and replicas are where unplanned cross-border copies usually hide.
Which rules?
GDPR, RBI payment data storage, CERT-In and Australian privacy principles.
Related
Often used with ResidencyMap
MaskWall
AI data firewallUse AI. Keep your secrets. A protective layer between your company and every AI service. Keys, passwords and customer data are blocked or masked before they leave, and quietly restored in the reply.
$199–499/month (₹8,000–25,000 in India)View product → Security & CompliancePrivacyPilot
DPDP privacy compliancePrivacy compliance, made practical. Find the gaps between your website and India's DPDP Act, and get the privacy notice, data inventory and consent banner to close them. Notices are checked against GDPR, UK, US and Australian rules too.
₹2,999 per siteView product → Security & ComplianceCERT-In Ready
CERT-In compliance checkCERT-In, checked properly. Check your infrastructure against the CERT-In Directions as written: 180 days of logs held in India, synchronised time and incident reporting.
₹25,000–75,000View product →See ResidencyMap on your own data
A 30-minute call. We run the product on your export, repository or document and walk you through the results.