Data Residency

Overview

Data residency is a common requirement in regulations and contracts. It refers to the physical or geographic location of a user or organization’s data or information. To comply with GDPR and similar regulations, applications need to be able to isolate data within the boundaries of a country or predefined region. Since many Trimble products rely on the Cloud Core Platform Services, it is critical that the Cloud Platform services support isolated regions.

The Cloud Platform team is approaching this effort by first focusing on regional isolation for personal data in the foundational Cloud Platform Services (Trimble ID, AuthZ, Profiles, and API Cloud). Regions in the United States and Europe will be supported. The next priority will be personal data in other Cloud Platform Services.

Regional isolation is already supported for Trimble ID. Trimble ID users can select the data region where their Trimble ID information is stored, and applications can retrieve the users’ data storage region preference from id and access tokens. Learn more about regional isolation in Trimble ID here.

Once all Cloud Platform Services are available in the EU, we will consider hosting Services in other regions. Some of the considerations for evaluating regional support:

Infrastructure feasibility: The Cloud Provider(s) and other supporting services used by the Trimble Cloud Platform Service must exist in the desired region.
Cost
- Infrastructure
- People: If the regulation or contract prohibits data from leaving a specified region, staff will need to be hired in that region to handle software deployment and support.
- Licensing
Business Impact
- Revenue
- Strategic value

FAQ

How long does it take to support a new region? Updated April 2023: Each service’s time required to support a new region will vary. It depends on the complexity of the service and the other tasks and priorities being worked on by the dev team. In most cases, integrators should expect to wait at least several months for a new region to be available due to competing priorities and the time it takes for changes to go through the development and release cycle.

Will all Cloud Platform Services exist in every supported region? To start, all Cloud Platform Services will be supported in US and EU regions. As new regions are added, the Services hosted there will be determined based on need.

What is the cost of supporting a new region? The cost of supporting a new region will vary by Service and region. The primary costs will be infrastructure, staff, and licensing or services needed to run a Service. Serverless applications like Trimble Identity require fewer static resources and thus cost less to deploy to new regions, with costs tied closely to load. Other services require additional resources like networking and database to run at all times in a new region, while others like API Cloud have contract costs associated with each region.

Is anything different for China? Chinese regulations make a China region more difficult to support than other regions. Many of the services used by Cloud Platform Services may not be available in China. As a result, a Service may need to be re-architected, or functionality may need to be disabled in a China region. In addition, due to the complexities of operating within China, a legal and security review of the services to be deployed and a review of the use cases to be supported will be required.

How will my application access the different regions? Most services will have unique endpoints for each region. Applications will be able to choose the region they want to use by calling the unique endpoints for that region.

What about FedRAMP? FedRAMP is a U.S. government program that provides a standardized approach to security, authorization, and monitoring for cloud-based products and services. Some government agencies and government contractors are only permitted to do business with FedRAMP authorized service providers. FedRAMP compliance requires cloud services to be compliant and for the cloud provider (e.g., AWS) to also be FedRAMP compliant. All major cloud providers (AWS, Azure, Google Cloud Platform) have at least one region that is FedRAMP compliant. Our approach to FedRAMP compliance will be similar to the approach for regional isolation: a stand-alone region will be made available in the cloud provider’s FedRAMP compliant region.

Regional Isolation for Trimble ID

Regions

Trimble ID authorization codes, access tokens, and id tokens contain information on user region preferences. This enables products to determine where the customer has requested their personal data to be stored so the user can eventually maintain all platform and application data within one region.

Users can change their data region at https://myprofile.trimble.com. For a step-by-step walkthrough of this process, visit our https://help.trimble.com knowledge base article for instructions.

The values of these may be “us, “eu”, “eu-gb, or “ap-au”. If the user specifies no region, the default value of “us” is used.

Region information is:

Embedded in the:
- Authorization code
- Refresh token
- Unique identifier in client-side cookies
Added:
- To the user info endpoint
- As a claim in the access token and id token
- To the user profile (in Profiles)

NOTE: Trimble ID user data is stored in the region of the user’s preference, but other user data may still be stored in other regions.

Claims

There are claims on access tokens and id tokens for data_region, and decoded tokens have a claim: data_region. More information can be found under the Identity documentation (search for ‘Tokens’).

User Info Endpoint

The region exists as an attribute to the /userinfo endpoint and the endpoint shows the same content as a decoded id token.

User Profiles

Non-federated, non-managed users can access the Data Region selection when they update their Trimble ID profile information in https://myprofile.trimble.com. The data region options are Australia, EU, UK, and United States (default). Users who have not explicitly selected a region will see a default value of "us".