Security and compliance questions · Questions you will be asked
Data residency for the EU subsidiary
Place every part of a second deployment for an EU subsidiary (data, model call, logs, backups, eval set, your own access) so nothing personal leaves the EU.
designhardExercise · 4 min · 49 of 64
On this page
The pilot renewed, and the group's German subsidiary wants the same triage with one condition from its data protection officer. The design is a second deployment whose only link back to the first is a page of numbers.
After the renewal, the insurer's German subsidiary asks for the triage service: 400 claims a working day, the same claim forms, policy wording in German. Its data protection officer sets one condition: claimants' personal data is stored and processed in the EU, and any access from outside the EU is a transfer that the data processing agreement must cover. Today's deployment runs in the parent's cloud tenant in a region outside the EU, calls a hosted model API on your company's account, keeps a 30-day prompt log and a redaction token map, and its redaction misses 3% of personal mentions; assume three mentions a claim. Three defaults would carry over: nightly backups replicate to the parent's region, the parent's operations dashboard pulls per-claim output rows, and the eval set was labelled by the parent's two senior handlers. You and the other engineer on the account work outside the EU. Assume a claim is 4,300 input tokens and 160 output, priced at r per million input and 4r output.
Lay out the EU deployment, saying where each component runs and what, if anything, crosses back to the parent or to you, and name the one decision you need from the data protection officer before week 1.
A second deployment in an EU region of the subsidiary's cloud tenant, not a branch of the first.
In the EU: the claims views, the service, the output table, the prompt log and the token map. Backups go to the EU paired region, with the default replication to the parent switched off and recorded. The model call goes to the listing in that tenant's EU region, under the subsidiary's cloud agreement: the provider becomes its processor rather than our subprocessor, and residency is answered by a document it already signed. A hosted API is the fallback only with EU processing and retention written into the contract.
Cost does not argue for sharing: 400 × 4,300 ≈ 1.7M input and 400 × 160 ≈ 64k output tokens a day, so 1.7r + 0.26r ≈ 2r.
Back to the parent: a daily aggregate (counts by route, agreement on the weekly sample, p99, cost in r) with no claim ids and no text. The per-claim pull is replaced, not filtered.
The eval set is 200 of the subsidiary's claims, labelled in German by its handlers; the parent's set says nothing about German wording, and the parent's labellers reading EU claims is a transfer. Shared: code, prompt template and rubric, none personal.
Our access: reading the EU log from outside the EU is a transfer, so we debug on a placeholder view and the raw log stays in the EU. Redacted is not anonymous: assume the parent's 3% until a 200-description German sample measures it; 3% of 1,200 mentions is about 36 a day. The decision for the officer: may that view be read from outside the EU under standard contractual clauses? If not, an EU-based engineer holds the account, at the deal's cost.
places each component (data, service, log, token map, backups, model call, eval set, engineer access) explicitly in or out of the EU
catches all three carried-over defaults: backup replication, the dashboard's per-claim pull, the parent's labellers
prefers the in-region model listing under the subsidiary's agreement and says what it does to the subprocessor answer
treats remote reading of the log as a transfer, with the residual counted, and puts it to the officer as the one decision (reading the redacted view from outside the EU under standard contractual clauses), with an EU-based engineer as the fallback
limits what crosses back to aggregates with no claim ids and no text
costs the EU volume as a multiple of r and does not use it to justify a shared deployment
"Pin the hosted API to an EU region and point the existing deployment at it." Loses because the model call is one component of eight: the views, the log, the backups and the engineers' access all stay outside the EU, and the officer's condition covers storage and access, not only processing.
"The prompt is redacted, so it is not personal data and can go anywhere." Loses because a 3% miss rate on about 1,200 mentions a day leaves roughly 36 personal mentions daily, and the officer will sample the log before signing.
"Reuse the parent's 200-case eval set to save the labelling." Loses because the parent's cases measure nothing about German wording, and the alternative, sending German claims to the parent's labellers, is the transfer the condition forbids.
Two paths cross the EU line: counts to the parent, and a redacted view that is still a transfer.
