I'm handling DBA, architecture, software engineering, SRE, and systems administration for a small but rapidly growing company. We're expanding internationally and may outsource some database and development work, but both our internal policies and customer contracts require data to remain inside the country.
I'm struggling to understand how organizations provide follow-the-sun support while enforcing that requirement. For our offshore team, I set up a Windows server with copy-and-paste disabled and restricted internet access. However, the workflow is painfully slow: DBAs have to upload scripts to object storage, download them onto the server, and work through the remote environment. The current setup also supports very little concurrency, which may become a problem as we grow.
We use AWS across more than 30 accounts and environments, so I considered a hosted desktop service, but the pricing seemed excessive. Dedicated Microsoft infrastructure and separate licensing for local laptops and cloud desktops also make the approach difficult.
How have others handled data sovereignty and third-party access? I'm especially interested in practical architectures that protect against bulk exports without making routine development and database work unusably slow.
2 Answers
A hosted cloud PC can work well for this. Give the offshore staff a managed Windows 365-style desktop and keep the sensitive systems, files, and tools inside that environment. With the right endpoint policies, clipboard transfer, drive mapping, printing, downloads, and other exit paths can be disabled or tightly controlled. The interactive desktop experience is usually much better than having everyone share one server, although access to the data may still feel slower than local work.
It’s important to define what “data cannot leave the country” actually means. If a person in another country can view readable customer data on a screen, then the data has already been transmitted there. Blocking copy and paste mainly reduces accidental or large-scale exports; it cannot eliminate deliberate photography, transcription, or other side channels.
A stronger design is to keep the data and decryption keys in the permitted country, provide foreign staff with only the minimum access they need, and expose sanitized or aggregated datasets whenever possible. Use database roles, just-in-time access, auditing, query and export controls, session recording where legally appropriate, and alerts for unusual activity. For sensitive fields, consider encryption or tokenization where the offshore users do not possess the keys.
There is still a difference between someone manually seeing a limited result and being able to export an entire database. Many organizations treat the former as an accepted residual risk and focus controls on preventing bulk extraction, while documenting that decision for compliance and customers.
That distinction is how we approached it too. We couldn’t prevent every possible side channel, but we could prevent bulk reports and exports, restrict access to the minimum required, and investigate anything suspicious.
I’ll look into cloud PCs again, especially whether the policy controls and concurrency are better than our current server setup.