Data residency for file sharing: how to answer clients
Data residency vs data protection law: a checklist to answer clients and a storage region you can set per Workspace.
When a client asks "where do you store our data?", they are usually asking two different things: in which country the files sit, and which rules protect them. Data residency for file sharing answers the first question. Data protection law answers the second. This guide separates the two, gives you a checklist for a clear reply, and shows how to pick a storage region you can explain in one sentence.
This is general information for agency and consultancy owners, not legal advice. Your client's contract, their own legal adviser and the law that applies to them decide what you must do.
Data residency and data protection law are not the same thing
Data residency is where data is physically stored. For a file sharing tool, that means the region where your uploaded files sit: a country or a group of countries such as the European Union.
Data protection law is the set of rules that govern how personal data may be collected, used, shared and moved.
That is why "our files are in the EU" is a useful fact but not a full answer. A client may also want to know who can access the files, what happens when data moves between countries, and what contract sits between you and your provider. Storing files in a region can help you meet a client's expectations. It does not by itself decide which law applies, and it does not make a service compliant with anything.
Why this is a live question for clients
Clients often ask where their data lives and who can reach it. A region answers only part of that question. Access rules, contracts and the law answer the rest. This guide does not take a side on how far a region should go. It gives you a way to state facts accurately and let the client judge.
What to check before you answer a client
Before you reply, collect the facts. A checklist keeps the answer short and correct.
What data is involved? Files only, or also names, emails and activity records? Ask the client whether the files contain personal data, and whether any of it falls into special categories. Tarkle's Privacy Policy names health, biometric and religious data as special categories.
Where are the files stored? Name the region your provider stores them in, and where you chose it.
What is not covered by that region? Tarkle's Privacy Policy says account, billing, support and operational data may be processed in the United States and other countries where Tarkle and its providers operate. Say so plainly rather than letting "stored in the EU" imply more than it does.
How do transfers out of the region work? If data can leave the EEA, UK or Switzerland, ask which safeguards the provider uses. Tarkle's Privacy Policy names Standard Contractual Clauses, the UK Addendum or another approved mechanism.
Who can see the files on your side? Name the team members, roles and links that have access.
How long do deleted files stay recoverable? Tarkle's recovery bin keeps deleted items for 30 days on Free and 90 days on Pro. Give the client the figure for your plan. See file retention and recovery.
Does the client's contract say anything about location? Some contracts name a region. Some only name a law. Read it before you answer.
Keep one page of answers to these seven questions, dated, and update it when your setup changes. When a client asks, you paste facts instead of writing from memory.
Data residency for file sharing: how to choose a region
Start from the client, not from the tool. The best region is the one you can explain and that matches what the client wrote down.
Follow the contract first. If the client's contract or procurement rules name a region, use it.
Then follow where the client and their people are. Europe for European clients, the United States for US clients, and Hong Kong or Australia for clients in Asia-Pacific or Oceania.
Keep each client's files together. If one client needs a different region from another, treat them separately rather than picking one region for everyone.
Decide before you upload. Moving later costs a one-time fee and takes time, so choose at the start.
Tarkle lets you choose where a Workspace's files are stored. The region picker offers Europe (GDPR), United States, Hong Kong and Australia, plus a default called US Global, which is stored in the United States. Tarkle's Privacy Policy lists four storage regions: the European Union, the United States, Hong Kong and Australia. For the feature itself, see choose where your files are stored.
You choose the region when you create a Workspace, in the field labelled Data residency. The field is pre-filled with a suggested region, so check it rather than accept it without looking.
If you run an agency, the region can follow each client. The Agency plan includes 20 workspaces for clients. When you create a workspace for a client, the second step of the dialog sets the client's storage share and its data residency. See a workspace for every client. On a reseller's own platform, the region is the partner's and is preselected in the dialog.
What a region does not change
Be precise about the limits, because clients notice vague answers.
Other data may sit elsewhere. Tarkle's Privacy Policy says account, billing, support and operational data may be processed in the United States and other countries where Tarkle and its providers operate. Files stay in the region you chose.
Transfers have safeguards. For transfers out of the EEA, UK or Switzerland, the Privacy Policy says Tarkle uses Standard Contractual Clauses, the UK Addendum or another approved mechanism. Read the Privacy Policy itself rather than relying on a summary.
A region is not a legal guarantee. It does not settle which law applies to the data. If your client needs a legal view, they should ask their own adviser.
Special categories need a lawful basis. The Privacy Policy says Tarkle does not intentionally collect special categories of personal data, and that you should not upload them unless you have a lawful basis.
Changing region is paid and limited. A Workspace can change its region one time. The owner of an organization on Pro or Agency is the only one who can request the move. The Change region dialog shows a $49 one-time fee before you confirm. The move can take up to 5 business days, depending on your storage. All transfer links are disabled during the move, only files are moved, and existing transfer links must be reactivated by hand afterwards. Choose carefully the first time.
How to answer the client
Keep the reply short, factual and free of promises you cannot keep. Say where the files are, say what that does and does not cover, and point to the written documents.
Use this template and fill in the brackets: "Your files are stored in [region] on [provider]. We chose that region when we created your Workspace. Account, billing and support data may be processed in other countries, as the provider's Privacy Policy describes, and transfers out of the EEA, UK and Switzerland use the safeguards listed there. This is a description of our setup, not legal advice. If you need a data processing agreement or have questions about your obligations, tell us and we will send the documents."
If a client wants more than a description, offer the documents: the provider's Privacy Policy, its terms, and your own contract. Do not describe your setup as "compliant" or "certified" unless you hold the paper that says so. You can also point to what you control day to day, such as who has access and when a link expires.
If a client asks who opened a file, the activity log of your workspace can help. The Activity page shows up to 50 entries, each with the item, the action (such as Viewed or Downloaded), who did it and the time. You can search the rows by name and export selected rows to a CSV file. It is a record of recent actions, not a full history: the page has no date filter and does not load older entries. How the activity page works lists each column and button.
Common mistakes
Saying "our data is in the EU" without saying which data.
Treating a region as proof of compliance.
Choosing a region after files are already uploaded.
Using one region for every client when contracts differ.
Promising what a provider's documents do not say.
Next step
Write your one-page answer today, using the checklist above, and check it against Tarkle's Privacy Policy and your client contracts. To set a region per client, start for free and try Tarkle with real files. The Free plan includes 1 workspace. For one region per client you need more workspaces, so compare the pricing page before you choose a plan.
What to remember about Tarkle
Tarkle lets you choose a Workspace's storage region: Europe (GDPR), the United States, Hong Kong or Australia. Files stay in that region, while account, billing and support data may be processed in other countries, as the Privacy Policy describes. Free includes 1 workspace, and the Agency plan includes 20 workspaces for clients. Start for free.