Advanced Email Security module security and compliance - The Cortex Regional Machine Learning (ML) Processing and Data Residency Policy ensures all Cortex XDR/XSIAM data processing, including GenAI, remains within your selected region, guaranteeing data residency and compliance. - Administrator Guide - Cortex XDR - Cortex - Security Operations

The Cortex Regional Machine Learning (ML) Processing and Data Residency Policy ensures that all data processing within your Cortex XDR tenant, including GenAI-powered features, remains in the region you selected.  This guarantees that data is not transferred across regional boundaries without your explicit approval. The policy is enforced by ensuring that the physical location of our ML and GenAI compute resources, not just data storage, is confined to your chosen region, providing a transparent and unified approach to compliance.

Data Handling and Retention

In the context of cloud-based ML systems, it is critical to distinguish between data at rest and data processing, especially when considering data residency and compliance boundaries.

Data at rest refers to the physical location where data is stored when not actively being processed. This typically includes storage services such as object storage (e.g., GCS, S3) or databases (e.g., BigQuery, Cloud Spanner). Data at rest is governed by storage policies and encryption-at-rest controls.

Data processing refers to where the data is actively loaded into memory, transformed, and used by compute resources, such as GPUs, TPUs, or CPU-based inference services, to perform ML/GenAI tasks like inference, embedding generation, summarization, etc.

The physical location of the compute resource performing inference, for example, the zone where the GPU runs the model, is what determines the true location of data processing, not the location of the stored data or control plane. This has direct implications for data egress, compliance, and user consent.

For example, if user data stored in europe-west3 is sent to a GenAI inference engine running in us-central1, then the data is no longer regionally contained, even if it returns post-processing. This cross-region processing is what our policy aims to prevent or explicitly disclose. This is crucial because customer expectations for regional processing often align with regulatory zones; for instance, a European customer might be comfortable with processing in another country in the EU, as both are part of GDPR, but an Asian customer may object to processing in another Asian country.

Our policy explicitly emphasizes regional ML inference locality as the primary control point for enforcing data residency, not just where data is stored.