Data residency in India: where your app and data run
Where your app, database and backups are held, what the DPDP Act 2023 expects of you as a business, and which parts of data compliance stay your responsibility.
“Where does the data live” is a question with two audiences. Your users ask it about latency. Your auditor, your enterprise customer’s security questionnaire, and increasingly your own obligations under Indian data protection law ask it about jurisdiction.
This page answers both for Voroa, and is clear about which parts remain yours.
Where Voroa runs
Your application, your managed database, and the builds that produce your releases all run in India. Backups are held in India as well. Three things are stored with a storage provider in the Asia-Pacific region on a best-effort basis, and may sit outside India: files in Voroa Object Storage, build cache copies of your compiled code (kept up to 14 days), and the logs your services and builds print (kept 30 days).
There is no region to choose and no setting to get wrong, so your services, databases and backups always run in India - the three exceptions above are the only data stored elsewhere. If you need that stated formally for a security review, including how it applies to any third party involved in delivering the service, ask support rather than quoting this page — a questionnaire answer should come with our name on it.
This matters more than it used to. A platform that offers an Indian region alongside a dozen others is one misconfigured default from running your workload elsewhere — and the default is very often somewhere else. A platform with one jurisdiction cannot make that mistake on your behalf.
What this means for latency
Physical distance is the part of response time you cannot optimise away in code. A request from Mumbai to a server in Europe or the US spends most of its time in transit, and no amount of caching inside your application changes that.
Running in India removes that leg for Indian users. It is usually the single largest improvement available to an application whose users are here and whose server is not.
The DPDP Act, briefly
India’s Digital Personal Data Protection Act, 2023 governs the handling of personal data. The framing that matters is that the obligations largely attach to you, the entity deciding what personal data to collect and why — not to your hosting provider.
In broad terms you are expected to collect personal data for a lawful purpose with notice, keep it only as long as that purpose requires, secure it with reasonable safeguards, and be able to respond when a person asks what you hold about them or asks you to erase it.
Your host is part of how you meet the security obligation. It is not a substitute for it. Choosing an Indian host does not make an application compliant; it removes one category of question — the cross-border transfer one — and gives you a straightforward answer to where the data sits.
This is general information rather than legal advice. Where personal data is central to your product, take advice on your specific obligations.
What Voroa is responsible for
- Running your services and databases in India.
- Physical and network security of the underlying infrastructure.
- Encrypted, automated backups of managed databases, held in India.
- Encryption of stored secrets. Environment variable values are encrypted at rest and are write-only: no interface reads one back, so support cannot show you a value — only replace it.
- TLS on your custom domains, issued and renewed automatically.
What remains yours
- What personal data you collect, and why. Voroa cannot know what is in your database.
- Your application’s own security — authentication, authorisation, input handling, dependencies.
- Notice, consent and erasure flows for the people whose data you hold.
- Third parties you send data to. An analytics tag, an email provider, or a model API that receives your users’ data is a transfer you have made, and it is outside Voroa regardless of where Voroa runs.
- Retention. Deciding how long you keep records, and actually deleting them.
That last list is the one that decides whether you are compliant. The hosting question is the easier half.
Answering a security questionnaire
The facts most questionnaires ask for:
- Services, databases and backups are stored and processed in India. Object Storage files and service and build logs are stored in the Asia-Pacific region on a best-effort basis and may sit outside India.
- Managed database backups are automated, encrypted, and held in India.
- Secrets are encrypted at rest and are not readable back through any interface.
- Traffic to your services is served over TLS with certificates managed by the platform.
For anything beyond this, contact support rather than inferring an answer.