I'm covering DBA, architecture, software engineering, SRE, and sysadmin responsibilities at a small but fast-growing company. We're starting to use an international, mixed team and may outsource database administration and development work.
Our company and customers require that data remain within the country. I'm trying to understand how organizations operating global or follow-the-sun support provide meaningful assurance that sensitive data does not leave the approved region.
For our overseas team, I set up a Windows server with copy and paste disabled and restricted internet access. However, the workflow is very slow: the DBA has to upload scripts to S3, download them onto the server, and work through that environment. It also supports very little concurrent usage, which may become a problem as we grow.
We are entirely on AWS across more than 30 accounts and environments. I considered AWS WorkSpaces, but the cost seemed excessive, and Microsoft licensing appears to require dedicated infrastructure and potentially duplicate licensing for the employee's local machine and cloud desktop.
What approaches have worked for enforcing data residency and limiting data exfiltration when third-party or offshore staff need access?
2 Answers
First, define what “data cannot leave the country” actually means. If an overseas worker can view readable records on a screen, the data has already been transmitted to that person’s location. Blocking clipboard access or file downloads mainly prevents bulk or convenient extraction; it cannot eliminate risks such as photographs, screenshots, handwritten notes, or deliberate disclosure.
For stronger compliance, keep the data and encryption keys in the approved region and give the remote team only the minimum access needed. Consider masked or tokenized data, tightly scoped database roles, audited queries, just-in-time access, export controls, and monitored administrative sessions. The goal is usually to reduce and detect bulk exfiltration rather than claim that a remote human can never see the data.
Exactly. You can prohibit personal devices in highly controlled facilities, but that isn’t realistic for most distributed teams. Written policies, logging, least privilege, contractual obligations, and consequences for misuse have to cover the residual human risk.
A hosted cloud desktop may be a better fit than a shared Windows server. Windows 365 Cloud PC, for example, can keep the working environment and data under your control while allowing the remote team to access the tools they need. With the right endpoint and tenant policies, you can disable clipboard transfer, local drive mapping, printing, downloads, and other ways of moving data out. The interactive desktop experience should be much smoother, although network latency will still affect database work.
That’s worth investigating. I’ll compare Cloud PC options with the licensing and cost requirements.
There’s still a practical difference between someone photographing a screen and being able to run an unrestricted report that exports an entire database. Many organizations treat the former as an unavoidable, managed risk while putting strong controls around the latter.