On this page

📋 Data Residency Checklist

Workshop 1 — Exercise 1, Step 3

Fill in the “Your Observation” column as you explore the Data Residency settings for your GHE.com organization.

In-Region vs Out-of-Region Data

Category Data Type Expected Residency Your Observation
✅ Inside region Source code (Git repositories) Stored in Japan  
✅ Inside region Issues, pull requests, discussions Stored in Japan  
✅ Inside region Wikis Stored in Japan  
✅ Inside region User profile data (EMU-managed) Stored in Japan  
✅ Inside region GitHub Actions logs & artifacts Stored in Japan  
⚠️ May leave region Copilot telemetry & usage logs Processed by Copilot service  
⚠️ May leave region Billing & support data Managed globally  
⚠️ May leave region Secret scanning validity checks External service validation  
⚠️ May leave region Certificate transparency logs TLS cert info shared with global CAs  

Your Trust Boundary Diagram

Draw or describe the trust boundary for your organization:

  • What’s INSIDE the boundary?
  • What CROSSES the boundary (and under what conditions)?
  • What’s OUTSIDE the boundary?
┌─────────────────────────────────────────────┐
│               INSIDE (Japan)                │
│                                             │
│   (list your in-region data here)           │
│                                             │
├─── CROSSES BOUNDARY ────────────────────────┤
│                                             │
│   (list data that may leave the region)     │
│                                             │
└─────────────────────────────────────────────┘

Key Questions to Answer

  • Can you confirm the region setting in the organization admin panel?
  • Which data types are you most concerned about leaving the region?
  • How does this trust boundary affect your compliance requirements?
  • What compensating controls exist for data that leaves the region?