Do a vendor’s data residency promises also cover logs, backups and support data?
Not always, so ask about each kind of data separately. A vendor may keep your main database in the EU while backups, error reports, support tickets, analytics, e-mail delivery or the staff who answer your tickets sit elsewhere. Each of those can contain personal data or details of your network, such as IP addresses, device names or screenshots. Ask the vendor for a list of data categories with the location and the sub-processor for each, and check that the data processing agreement covers all of them, not only “customer data” in the narrow sense. Also ask where staff with administrative access are based, since remote access from outside the EU can be a transfer too. For NetSenX, customer data is stored in the EU, with the database in Ireland and the API in Frankfurt and Paris, and the sub-processors are listed in the data processing agreement. That list is the place to check where each service runs; if anything is unclear, ask us before you sign.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Which questions should we ask a security vendor about its sub-processors?
- Does a network monitoring service need a data processing agreement?
- Is the NetSenX data processing agreement public, and what does it commit to?
- Where does NetSenX store data about our employees’ devices, and for how long?
- Do we need a data protection impact assessment before deploying network monitoring?