"We run on AWS" is not a data residency answer. Neither is "US-based company" or a vague promise that customer data "stays in the United States."
Agency buyers evaluating outbound platforms are often stuck in the middle. Their clients ask where prospect and mailbox data lives. Procurement wants a region name. Security wants backups and subprocessors. Marketing wants to start sending yesterday.
This is the short list of questions that separate a real residency claim from brochure copy. GTM's honest answer up front: primary residency is US us-east-2 (Ohio), US-only today, with SOC 2 Type II and ISO 27001 in progress rather than certified. Use the questions below on any vendor, including us.
Residency is not sovereignty
CloudNuro's buyer guidance draws a useful distinction:
- Residency means data at rest lives in a stated geography
- Sovereignty means the data is subject only to that country's laws in a stronger sense
- Localization means create, process, and store without leaving the country
Most agency SaaS evaluations are residency conversations. Saying "US residency" does not automatically answer support access, backup regions, or subprocessor chains. CloudNuro's residency FAQ also notes that picking a hyperscaler region is necessary and not sufficient. The SaaS vendor still has to architect and contract for that region.
Ask where primary data sits at rest
Get a specific cloud provider and region, not a continent.
Good answer shape: "Primary customer workspace data at rest is in AWS us-east-2."
Weak answer shape: "US cloud" or "American data centers."
GTM names us-east-2 because buyers should be able to put a region on a security questionnaire without decoding marketing language.
Ask about backups, replicas, and failover
The classic gotcha is primary in one region and disaster recovery in another country. If failover silently moves client prospect data across a border your contract forbids, you find out during an incident.
Ask:
- Where do backups live?
- Are read replicas in other regions?
- What happens to residency commitments during DR?
If the vendor cannot answer without a week of email, assume the architecture is accidental.
Ask who can access the data and from where
Storage location and access location are different. Support engineers, success managers, and subprocessors may reach into workspaces from other countries even when disks stay put. For some regimes that access counts as a transfer. Even when you are US-only, you still want named access controls, logging, and least privilege.
Agency angle: your clients may be more sensitive than you are. A healthcare-adjacent or fintech client can force the issue even if your agency defaults are casual.
Ask for the subprocessor list with locations
Outbound stacks touch enrichment providers, email infrastructure, calendar tools, LinkedIn connection vendors, and storage. Residency claims collapse if a critical subprocessor quietly processes abroad.
You want:
- Current subprocessor list
- Processing locations
- How change notification works
AWS publishes its own sub-processor materials, which is useful context and still not a substitute for your SaaS vendor's list.
Ask how deletion and export work at offboarding
Residency questionnaires often stop at "where is it." Agency offboarding also needs:
- How client workspace data is exported
- How suppressions are retained or transferred for compliance
- How backups age out after deletion requests
A region name with no deletion story is incomplete.
Put it in writing
Verbal diligence fades. Buyer guides consistently recommend contractual language for storage location, subprocessor transparency, and access controls. If a vendor will only talk residency on a sales call, treat the claim as unfinished.
How this fits GTM's honest posture
GTM is US-only today with data residency in us-east-2. SOC 2 Type II and ISO 27001 are in progress, not certified. GDPR-oriented data modeling exists while the operating posture remains US-only. HIPAA is not in scope. That mix is intentional honesty for agency buyers who are tired of "enterprise-ready" stickers without region detail.
If your client requires EU residency or certified SOC 2 today, say so early. Do not force-fit a US-only platform into a requirement it does not meet.
Agency-specific gotchas
Agencies hold other people's go-to-market data. That changes the diligence conversation.
Your client may require US-only residency even when your agency is comfortable with broader hosting. A single shared platform used across many workspaces means one weak residency answer can block an entire book of business, not just one brand. Isolated workspaces help with access boundaries, but they do not invent a region that does not exist.
Also separate mailbox and calendar connection data from prospect list data in your questionnaire. Outbound tools often mix enrichment records, send logs, reply content, and OAuth tokens. Ask which of those sit in the named region and which are handled by connection vendors.
What a good one-pager looks like
When a vendor is ready, you should be able to paste answers into a client security packet:
- Primary region and cloud provider
- Backup and DR regions
- Support access model and logging
- Subprocessor list with locations
- Retention, export, and deletion behavior
- Current certification status stated without fluff (in progress vs attested)
If any line is missing, keep asking. Residency theater wastes more calendar time than a blunt "we are US-only in us-east-2 today."
CTA
Agencies that want US us-east-2 residency named plainly, client-isolated workspaces, and outbound with a compliance gate can join the GTM waitlist at https://trygtm.com/waitlist.
Sources
- CloudNuro: Data residency in SaaS, questions to ask
- AWS sub-processors
- GTM product notes on us-east-2 residency and security posture