The best cloud platform for multinational companies with data residency requirements

Microsoft's Azure regions list places public regions in 32 countries or territories, against 29 on Google Cloud's Compute Engine table and 27 on the table AWS publishes for a standard account. That spread, together with data residency terms that commit Microsoft to storing and processing customer data inside the geography you select, subject to a published list of service exceptions, is why we name Microsoft Azure the best cloud platform for a multinational company with data residency requirements.

AWS is the better pick for a company that qualifies for an environment run apart from the public cloud and wants one: AWS GovCloud (US) or the AWS European Sovereign Cloud. Google Cloud suits a company that wants location and support-staff controls applied inside the public cloud regions it already uses, through Assured Workloads.

What should a multinational weigh when data has to stay in specific countries?

The UK National Cyber Security Centre tells cloud buyers to obtain "the countries in which your data will be stored, processed and managed" and notes that the answer differs from service to service. A count of regions answers a different question. A second region in a country you already cover gives you a place to recover inside the border, and it does nothing for the subsidiary in the country next door.

The NCSC also points out that a storage region in one country can depend on an authentication service replicated worldwide, and UK government guidance on multi-region cloud says public clouds "will often send data between regions as metadata or for billing purposes." So the residency term to read is the one that says what it covers: storage, processing, support access and the identifiers a service generates. The UK Information Commissioner's Office adds a legal test under UK GDPR that sits apart from server location: "The contractual location of where the service provider is established determines whether a transfer is a restricted transfer."

The same UK government guidance says a single-region outage can take a service offline, and that an overseas recovery region is an option when legal, data-protection and security requirements are satisfied. Where your rule closes off that option, examine two things inside the permitted boundary: any further regions the provider lists there, and the zones open to your account in each.

Azure marks some regions on its list as restricted and opens them through a support request, and Google ties its Dammam region to how the customer is billed. A condition like that lands on one subsidiary and one contract, so confirm that each listed location is open to the account that will deploy there before the design depends on it.

The NCSC notes that "Some FEDRAMP certifications only apply to services hosted in a dedicated instance used by the US government." A government or sovereign environment run apart from the public cloud has its own accounts and its own service list, so an assurance earned in one does not carry over to the other. The legal entity that signs also has to meet that environment's eligibility rules.

Availability commitments are specific to each service in the NCSC's guidance, which says a supplier's assurances need to cover the service and deployment you will use. A residency rule that leaves you one permitted region removes the usual fallback of running the service somewhere else. That puts two checks in the plan for every country: whether the service you need is offered in that region, and what the provider's health page reports for it.

Azure, AWS and Google Cloud by country coverage and residency terms

Microsoft Azure: public regions in the most countries of the three lists

Azure's regions list includes Austria, Denmark and Norway, three countries that appear on neither the AWS table nor the Google Cloud table. Each row carries a physical location and a geography, and Microsoft's regions overview describes a geography as a data residency boundary. Most geographies on the list are single countries. Two are wider: Europe holds the regions in Ireland and the Netherlands, and Asia Pacific holds the regions in Hong Kong and Singapore.

Microsoft's data residency page says: "Microsoft will not store or process customer data outside the selected Geo." The page allows replication between regions inside the geography for resilience, and it leaves you and your users free to move or access the data from anywhere. It also lists services that can be configured to store customer data only in a single region in Singapore, Hong Kong or Brazil South, which narrows the Asia Pacific boundary to one of its two locations for those services.

Azure Machine Learning stores asset names and experiment metadata in the United States under the exceptions that page lists, and Azure Databricks stores user names and email addresses there. Foundry model deployments labeled Global process prompts and completions in any Microsoft Foundry region. Microsoft personnel outside the geography can remotely operate systems inside it, and the page says they will not access customer data without your authorization.

Microsoft's EU Data Boundary commits to storing and processing customer data and personal data for Azure inside the EU and EFTA countries, with limited circumstances in which data still transfers out. Regional Azure services deployed in a boundary region are in scope and non-regional services need configuration. For professional services data, the commitment covers storage at rest.

UK West and Korea South are among the regions the list shows with no availability zones. Microsoft's availability zones overview defines a zone as a logical grouping of one or more physically separate datacenters and adds: "Some zones have one datacenter and others have multiple." The regions list also says zone support varies by service inside a region that has zones.

France South, Germany North, Norway West and Switzerland West are among the regions Azure marks as restricted "to support specific customer scenarios, such as disaster recovery within a specific geographic area." Access runs through a support request that names the region, the organization, the deployment model and the initial quota, and Azure engineering validates it. In each of those four countries the second in-country region is one you apply for.

Azure Government runs in physically isolated datacenters and networks located only in the United States, and Microsoft validates eligibility for the US federal, state and local government customers and partners it serves. Microsoft commits there to limiting access to systems that process customer data to screened US persons. Azure in China is a physically separated instance operated by 21Vianet, which signs the customer agreement, and Microsoft notes a feature gap between it and global Azure. Microsoft's Sovereign Public Cloud runs in existing Azure regions, so it adds controls to locations already on the list.

Azure's status page showed no active events on October 8, 2026 (UTC). The page says it is used only for widespread incidents, so that headline is not a report on each service, and account-level checks belong in Azure Service Health. For each service in each country, the list to check is Products available by region.

AWS: separate partitions for US government and European sovereign workloads

The AWS European Sovereign Cloud opened on January 14, 2026 with a first region in Brandenburg, Germany, and the launch post describes it as infrastructure that is physically and logically separate from other AWS regions, with every component inside the EU. AWS says it is "operated exclusively by EU residents located in the EU," a commitment that covers technical support and customer service as well as day-to-day operations. Customer-created metadata such as permissions and resource labels stays within the EU along with the content.

The sovereign cloud is open to customers wherever they are located, and it is a separate partition with its own identity and billing systems. You create a new root account and new identities for it, and you contract with Amazon Web Services EMEA SARL. The launch post lists the services available there, EC2 and Amazon Bedrock among them, so the service list is a check to run before the account is opened.

AWS GovCloud (US) is a pair of isolated regions where AWS restricts its own staff's physical and logical administrative access to the infrastructure to vetted US citizens. The sign-up rules require the account holder to be a US entity incorporated and based on US soil and "a U.S. Person defined as a U.S. Citizen or active Green Card holder," and AWS reviews each applicant. For a multinational, that makes GovCloud an option for its US entity. A GovCloud account is tied to one standard AWS account for billing. In China, the Beijing region is operated by Sinnet and the Ningxia region by NWCD, and AWS requires separate account credentials for both.

AWS's data privacy FAQ makes the commitment for standard regions: "We will not move or replicate your content outside of your chosen AWS Region(s) without your agreement." The FAQ adds exceptions for services you initiate and for legal orders, and its definition of content leaves out account information such as email addresses and billing details. AWS also reserves the right for its global services, IAM and Route 53 among them, to "store and process data globally," and to process metering and billing data in regions other than the ones you use.

Every region in AWS's standard-account table shows at least three availability zones, and newer accounts get two in US West (N. California). Regions introduced after March 20, 2019 are switched off by default and are enabled per account in the console. The table includes Taiwan and Thailand, two locations absent from Azure's list.

On October 8, 2026 (UTC), the AWS Health Dashboard carried an open event for each of two regions in that table, Middle East (UAE) and Middle East (Bahrain). In a September 15 update AWS said it cannot restore access to resources and data hosted exclusively in one UAE zone, mec1-az2, and that work continues on the region's other two zones. For Bahrain, where damage spanned more than one zone, AWS said it is "unable to restore access to the resources and data hosted exclusively in this Region." The table lists one region in each of those countries, and AWS's guidance to affected customers is to restore from backups held in other regions and to weigh regions in the United States, Europe or Asia Pacific against their data-residency requirements.

Google Cloud: location and support-staff controls inside the public cloud

Google states that Assured Workloads "does not rely on physical infrastructure distinct from the existing Google Cloud public infrastructure." The controls come as packages, and the package list includes boundaries for India, Japan, Switzerland and South Korea alongside an EU boundary whose regions span several countries. The package named EU Data Boundary and Support limits support access to EU-based personnel. The EU Data Boundary package without the support tier is a location control. Google's overview adds: "Support for Google Cloud products and services varies by control package."

Google's service terms set the general commitment: "Google will store Customer Data for that Service at rest only within the selected Region or Multi-Region." It applies to the services on Google's data residency list. The terms permit replication to another region in the same country, or within the countries of the selected multi-region, for purposes that include backup and support. They leave resource identifiers and labels outside the definition of customer data, and they place no limit on where your own users access or move it.

The residency list has a separate section for AI and machine-learning services, where storage and processing can be set to stay within a selected multi-region for the services and models it names, with exclusions that include RAG Engine. Apigee is an example of a service that needs its own setup: regional control-plane storage requires a residency configuration and regional endpoints, and Google's Apigee guide says "If you don't add the Endpoint element, the policy defaults to the global endpoint."

Each region in Google's Compute Engine table lists at least three zones. Google's geography page names Stockholm among the regions whose three zones are housed in one or two physical data centers, and says those regions are expanding to at least three. Dammam is on the public table with purchase terms attached: a customer billed outside Saudi Arabia needs invoiced billing to use it, and a customer billed inside Saudi Arabia buys Google Cloud services through the reseller CNTXT, including services in other regions.

Google Cloud Dedicated is the separately run option, isolated infrastructure operated by local partners. Its product page lists France, where S3NS offers it and has achieved SecNumCloud 3.2, and Germany, where it is in preview. Thales will operate the German offering through an entity it owns. Billing runs through the partner-operated cloud.

Google's Service Health dashboard showed no broad severe incidents on October 7, 2026 (PDT). That headline covers broad incidents, and the dashboard points customers to Personalized Service Health for their own projects. New regions launch with a minimum set of services that includes Compute Engine and Cloud Storage, and Google expects further named products such as BigQuery within six months of a launch.

Which cloud platform should a multinational with data residency requirements choose?

Microsoft Azure is our pick for a multinational that has to keep data in a named set of countries. Its public list reaches more countries than either rival list, and its residency term covers processing as well as storage inside the geography you choose, with the exceptions written down service by service.

Azure's list includes regions without three current zones, and every region on the AWS and Google Cloud tables shows at least three, apart from the limit on newer AWS accounts in Northern California. Some second in-country Azure regions also need an approved request. The list has no row for Taiwan or Thailand, so a company with either on its list starts with AWS or Google Cloud there. We weigh coverage first because zones and second regions only help in a country the list already reaches. Check each service you plan to run against the exceptions on Microsoft's residency page before you treat a geography as the boundary.

Choose AWS when the requirement calls for an environment run apart from the public cloud and your entity qualifies for it. That is the US entity handling export-controlled data in GovCloud, or the European business that needs operations staffed by EU residents and metadata kept in the EU. Either one means opening a new account in a separate partition and confirming the services you need are offered inside it.

Choose Google Cloud when you want the controls without leaving the public cloud regions you already run in. Assured Workloads applies a location boundary to those regions, and a package such as EU Data Boundary and Support adds a limit on where support staff are based. Confirm that the package you pick supports each product in the workload.

Other cloud platforms