A Data Residency Checklist for Indian Enterprises

The person in a room at an Indian enterprise who has been handed a sentence like “we need a sovereign AI position” and told to come back with a vendor. That person is usually from infrastructure, security, or legal — and is expected to turn a slogan into a contract clause.

This checklist is the set of questions that separate the two. It is deliberately short enough to survive a vendor call: five minutes to run, and every question demands an answer in writing. A vendor that answers them plainly — including the ones that are awkward — is not necessarily your vendor, but a vendor that will not is never your vendor.

Sovereign AI separates into four independent layers, covered in depth in what sovereign AI actually means: jurisdiction (whose laws), residency (where the bytes live), infrastructure (whose hardware), and weights (who owns the models).

The checklist below walks the layers in the order they are most often fudged — inference geography first, because it is the claim vendors make loudest and prove least.

The first question, and the one that exposes the most. Not “where is the marketing site hosted?” — where does the math happen? Demand the answer broken down by workload, because a single line rarely tells the truth: a platform can run some of it in-country and send the rest elsewhere, and that split is fine if it is disclosed — and dishonest if it is not.

Use this platform’s own answer as the shape to demand, not the shape to beat. Every request, every fine-tuning run, every training run, and every model we host execute inside India. One sentence, no exception, printed on the public site. That is the standard to hold everyone to, us included.

Residency is where the data sits; retention is whether it sits anywhere at all. “Zero retention” should mean something specific and checkable: prompts and responses processed in memory for the life of the request, discarded at completion, never stored, never used for training — and said so in the contract, not just the marketing page.

Interrogate the edges: are embeddings or derived statistics stored? Are error samples kept for debugging? What does the deletion path look like when a customer closes an account? The strongest residency promise is the one that has nothing to move — and a vendor that keeps nothing has the shortest answers to all of these.

Ask for the operating entity by legal name, and look up where it is incorporated — that determines which courts and regulators can reach it. “Global” or “world-class” is not a jurisdiction.

Then ask who operates the deployment itself. The strongest available form is the stack inside your own boundary: serving and training installed into infrastructure you own, operated by the vendor on your hardware and your policy. This platform offers exactly that on enterprise deployments — and the operator is VTT AI Private Limited, Bangalore, an Indian company. Whatever vendor you choose, the operating entity’s home jurisdiction should be a fact you can state from memory, not something you discover during a dispute.

The weights layer decides whether your AI investment is an asset or a subscription. Two questions settle it: are fine-tuned checkpoints exported to you as files, and is there a documented exit that moves more than promises?

On this platform, the checkpoint is the customer’s property — exported, portable, servable anywhere, on dedicated endpoints or elsewhere entirely. Demand the equivalent sentence from any vendor, and treat vague phrasing (“we support industry-standard portability”) as a no until it names a file format and a transfer path.

Every vendor should be able to answer, for each jurisdiction it operates under: what can be compelled to be disclosed? The answer depends on what exists — a platform that retains nothing has nothing stored to hand over, which is the architectural answer rather than the legal one.

Ask for both answers anyway: which authorities can compel, and what the architecture holds. A confident vendor prints both. This one prints zero retention and memory-only processing on the public site; the legal answer to a specific demand is a matter between the demand and counsel, but the inventory a demand could reach is documented and short.

When the actual threat model has nothing to do with geography. If the real risks are prompt injection, hallucinated answers, or a support model misreading a field, then residency is a distraction: a vendor can pass every question here and still ship a system that leaks through a manipulated prompt. Name the risks first, then pick the layer that answers them.

When it becomes theatre. A checklist that gets graded by whether boxes were ticked, rather than by what the written answers say, is how organisations buy geography instead of control — and pay sovereignty premiums for it. The written answers are the deliverable; the boxes are just filing.

And when the organisation cannot operate what it buys. Infrastructure inside your boundary means your boundary: environments, network policy, procurement. A team that cannot run a reliable cloud workload today should buy managed capacity first and grow into the stronger layers as the capability arrives — not fail expensively in a data centre.

Five questions, asked in writing, scored plainly:

1. Where does inference run, broken down by workload? 2. What is retained, for how long, and where is that written? 3. Which entity operates the stack, and where is it incorporated? 4. Are the weights you train exported to you as files? 5. Which jurisdictions can compel disclosure, and what does the architecture hold?

Score each answer a zero if it is verbal, hedged, or hidden in a footnote — one if it is printed and specific. A vendor that scores five has earned a pilot; a vendor that scores three and will not close the gap has told you everything you need. And when you sit across from this platform’s own answers, hold us to the same scoring — the checklist is only worth anything if it is applied evenly.