EU customer data that stays in the EU, demonstrably.

A B2B SaaS expanding into Germany hit a Data Processing Addendum requirement: EU customer data must be stored, processed, and backed up exclusively in EU regions, with cryptographic enforcement and verifiable evidence. We re-architected the data plane for verifiable residency.

INDUSTRY

B2B SaaS

DOMAIN

SECURITY

DELIVERED

2024

STACK

EU-CENTRAL-1·EU-WEST-1·KMS·AURORA POSTGRES·S3·SCP·CONFIG

RESULTS

What changed, by the numbers.

DATA-RESIDENCY CONFIDENCE

100%

CRYPTO-ENFORCED

CONTRACT VALUES UNBLOCKED

€4.2M

GERMAN ENTERPRISE DEALS

REGION VIOLATIONS

SCP-ENFORCED

AUDIT EVIDENCE TIME

AUTO

CONFIG + AUDIT MANAGER

HOW IT WENT

The legal team had drafted a DPA assertion the engineering team couldn’t actually back up: "all EU customer data is stored, processed, and backed up in EU regions." The team’s architecture used US-East-1 for some backup jobs. Nobody had connected the two.

We rebuilt the data plane around EU-Central-1 (primary) and EU-West-1 (DR) for EU-tenant traffic. KMS keys for EU tenants were created in EU regions and pinned by key policy. SCPs at the org level blocked `s3:*`, `rds:*`, `kms:*` outside the approved EU region list for the EU production OU.

Config rules monitored cross-region replication paths; Audit Manager produced quarterly evidence. The €4.2M in pending German enterprise deals closed within two months of the architecture passing legal review. The DPA assertion is now provable.

RELATED · SAME DOMAIN

Other engagements in this space.

ARCO · 2026

Retired eighty IAM users in three weeks.

80 → 0IAM USERS RETIRED

FOSTER · 2025

Two million users migrated, no password resets.

0PASSWORD RESETS REQUIRED

PREVIOUSMARLOW — Sandbox accounts that clean themselves.NEXT FORGE — DynamoDB on-demand was cheaper. Until it wasn’t.

READY WHEN YOU ARE

Let's get your AWS bill (and architecture) in order.

The discovery call is free. You walk away with at least one concrete idea — even if we never work together.

Or email directly →