Data residency Where your data is stored and processed, and where it is not.
Short answer. Data residency is the physical or geographical location of an organisation’s digital information: the country or region where it is stored and, for AI, where it is processed. It says where data sits, not who can compel its disclosure, which is data sovereignty, and not whether the law forces it to stay in-country, which is data localisation. With cloud AI the two halves can differ. As of October 2026, OpenAI’s documentation lists an India region for data residency in which content is stored at rest in the region but regional processing is not supported, so a prompt can still be handled outside India. Ask where data is stored, where it is processed and who can reach it.
01
Three questions inside one phrase
The Government of Canada’s 2018 white paper on public cloud defines data residency as the physical or geographical location of an organisation’s digital information. When a vendor says “your data stays in India”, three separate things could be meant.
Question
What it covers
Example of the gap
Where is it stored?
Data at rest: files, chats, logs, indexes and backups
Stored in Mumbai, with backups copied to another region
Where is it processed?
Data in use: where the model runs when it answers
Stored in India, but the prompt is answered by a model running abroad
Who can reach it?
Staff, support engineers and administrators, and the agencies that can compel them
Stored in India, but a vendor engineer elsewhere can view it during support
02
What cloud AI vendors actually offer
OpenAI’s data-controls page, as of October 2026, shows how narrow a residency promise can be. When data residency is enabled, customer content for a project is stored at rest in the chosen region. Only regions marked as supporting regional processing also run inference there. The page lists an India region with regional storage but not regional processing, and says that where a region does not support regional processing, OpenAI may process and temporarily store customer content outside the region to deliver the service.
The same page excludes system data (account data, metadata and usage data), content that leaves the region because of where the end user or the customer’s own systems are, and services provided by other parties. Regions other than the United States also need approval for abuse-monitoring controls and a modified retention amendment. Other vendors’ terms differ, so read each one for storage, processing, support access, logs and backups separately.
03
What Indian law says about location
The DPDP Act, 2023 does not impose general localisation. Section 16 lets the Central Government restrict, by notification, the transfer of personal data to notified countries or territories outside India, and says that any other law giving a higher degree of protection or restriction continues to apply. Rule 15 of the DPDP Rules, 2025 adds that data may be transferred out subject to requirements the Government may specify about making it available to a foreign State or an entity under its control. Rule 15 comes into force 18 months after the Rules were published in November 2025, and the Act’s own provisions are being brought into force in step, so check the commencement notification for the date that applies.
Some sector rules do require storage in India. The data localisation page covers them. This is general information, not legal advice.
04
A residency checklist for any AI tool
Data
Ask the vendor
Why it matters
Prompts and uploaded files
Where are they stored, and for how long?
They often hold the most sensitive material
Model processing
In which country does the model run when it answers?
Storage in India does not mean processing in India
Logs and metadata
Does the same promise cover them?
OpenAI, for example, excludes system data
Search indexes
Where is the index built from my documents kept?
It is a derived copy of your documents
Backups
Where are the copies kept?
A backup in another region undoes the promise
Support access
Can staff outside India view my data, and is that logged?
Residency means little if remote access is open
Sub-processors
Which companies handle data for the vendor, and where?
The promise is only as good as its weakest link
05
Where ANVE stands
ANVE keeps data on the box in the office, and its security page (/security) says everything sits in one database on the box. The paths out are limited. Cloud models exist only if an administrator adds a provider, their answers are labelled, and a policy that blocks confidential data from cloud models is not on ANVE yet. Connectors exist only if an administrator approves one; each sends that service only what it is asked to fetch or send, and every call is logged on the box. The research app looks sources up online only when asked, and podcast narration uses a cloud voice today while local narration is not on ANVE yet. Every model call is logged with whether it ran locally or in the cloud. The office’s own legal duties remain the office’s.
06
Questions people ask
Is data residency the same as data sovereignty?
No. Residency is where data is stored and processed. Sovereignty is whose law and control apply to it, so data can sit in India and still be reachable under foreign law if the provider is subject to it. See the data sovereignty page.
Does Indian law require data to stay in India?
Not generally. The DPDP Act allows transfers unless the Government restricts a country by notification, and some sectors have their own storage rules, such as the Reserve Bank of India’s rule for payment data. This is general information, not legal advice.
If a vendor offers an India region, is my prompt processed in India?
Not necessarily. As of October 2026, OpenAI’s documentation lists an India region with regional storage but no regional processing. Ask about storage and processing separately and get the answer in writing.
Does on-premise AI give me data residency?
For the models and documents on the device, yes: they sit and run in your building. Check the exceptions, such as optional cloud models, online lookups, backups and remote support access.
07
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
