Data residency and GDPR: the right data in the right place

Why a German customer's legal letter forces a re-architecture: residency versus sovereignty, what counts as personal data, four regional patterns and per-tenant routing, lawful basis and recorded consent, cross-border transfers after Schrems II, DPAs and subprocessors, Slack's and AWS's approaches, and the mistakes that leak data across borders.