Read seven clauses before you believe a region selector, because data location and data custody aren’t the same thing. A service can store your records in the region you picked while another company’s still running the platform, holding the administrator plane, and answering the legal process.

Here’s the clause list we mark up, with what each one decides:

  • Administrator plane. Who can operate the service, including support and emergency access. This clause names the people who’ll see your system when something breaks at 2 a.m.
  • Subprocessors. The full chain, with change notification. Every entry’s another organization inside your threat model.
  • Legal process. For U.S. providers, 18 U.S.C. § 2703 describes process directed at providers for stored records; specifics vary with circumstances. The architectural point stays narrow: whoever holds the data shares control of it, in ways you’d better understand before signing.
  • Customer-managed keys. Does the arrangement restrict provider access in practice, or protect one storage layer while plaintext flows elsewhere? The marketing name’s identical in both cases.
  • Telemetry and improvement. What the provider learns from your prompts, attachments, outputs, and logs, and whether any of it feeds their models.
  • Deletion and return. Usable formats, verified erasure, and what’s left of derived indexes, caches, and backups when you leave.
  • Suspension and exit. What stops working the day the relationship sours, and whether a mission function’s standing on it.

The commentary matters more than the list: this exercise isn’t an argument that cloud services are unacceptable, and plenty of workloads sit comfortably in an approved service, mine included. The argument is that classification comes first.

Public drafting tolerates shared custody. Privileged, regulated, sovereign, or export-controlled material may demand a dedicated environment, local processing, or a different workflow entirely. The honest way to decide is the clause list beside the data-flow diagram, checking they describe the same reality; when they don’t, believe the contract.

We treat the cloud agreement as a security document with a billing section attached. Read it the way you’d read a firewall config, and give the exit clause the attention everybody’s saving for the pricing page.