Sovereignty audit: OVH Gravelines production, slide approved. Question: where do automatic snapshots go? Answer after three days: Poland replication plus US East object archive for the "geo-redundant" offer. Production data was French; the copies were not.
Sovereignty and compliance analyses focus on the VM or main bucket region. Backups — snapshots, DR replication, tapes, support exports — are the forgotten copy. Same content, sometimes a different legal regime.
Copies to track in your architecture
Start by inventorying every mechanism that duplicates your data. Automatic snapshots may stay in the same region or replicate elsewhere depending on the chosen offer. Disaster recovery replication is often enabled by default for resilience — without the salesperson mentioning it explicitly.
Host-managed backups differ from marketing catalogues: verify what is actually restorable and how long it takes. Support or forensics exports are temporary but real — a copy exists somewhere. Finally, your own scripts (restic to another bucket, rsync to your premises) also count in the map.
| Copy | Often ignored risk | Recommended action |
|---|---|---|
| Cross-zone snapshot | Intra or extra-EU transfer | Disable or contractually frame |
| Cold archive | Third country | Documented DPA and safeguards |
| CDN log backup | United States | Anonymize or choose EU POP |
"Hosted in France" without "backups in France" is a half-truth.
Contract and prove location
Require a written schema covering production, backup, DR, and logs. For sensitive projects, ask for a no cross-border backup option. Encryption with keys you control strengthens the position — see KMS key management.
Compare providers via the directory and cross-check Real location investigation if available. A vague "GDPR compliant" clause does not replace a region list per copy type.
Align GDPR register and technical architecture
The processing register must reflect all relevant copies, not just the main server. During an audit, the supervisory authority or an enterprise client will ask where snapshots and archives live — not only the production database.
Document who validated the schema, when, and which commercial offer triggered it. A migration or switch to a "geo-redundant" option must trigger register update and contractual safeguard review.
The peak: the copy that invalidates the slide
Decide and move forward without blind spots
Ask your host this week for the complete backup schema, with exact regions for each copy type. Disable cross-region replication if it is not needed for your continuity objective. Update the GDPR register to include identified copies. If the current provider cannot clearly document location, use the compare tool and read Cloud reversibility before renegotiating or migrating.
Frequently asked questions
Do backups follow the production region?
Not automatically. Many offers replicate snapshots to another zone — sometimes outside the EU. Check DR configuration, not just the region shown on the VM.
Does a backup count as a transfer outside the EU?
Yes if personal data is copied to a third country without appropriate safeguards. Map backups, archives, and logs together in your transfer analysis.
What should I ask the host?
Backup regions, cross-region replication, cold storage subcontractors, encryption per region, and local-only backup if your project requires it.
Is a local backup at the client enough?
Useful as a complement; it does not replace contractual clarity on copies the host creates on their side without you seeing them in your client area.
Sovereignty is read on the map of copies — not only on the main datacenter flag.