Is My Data Safe in the Cloud?
Key takeaways
- No cloud provider is breached by accident; the failures are open storage, over-permissive roles and a missing backup, all of which are configuration the customer owns.
- Under the DPDP Act 2023, data must be stored and processed in India unless the central government has notified a transfer, which makes the region of your bucket a compliance fact, not a preference.
- Encryption at rest with provider-managed keys protects against disk theft, but envelope encryption with a customer-managed key gives you the ability to revoke access to your own data.
- Test a restore from the cloud backup at least twice a year, because a backup nobody has restored is only a hypothesis.
- Under the shared responsibility model you are the data fiduciary for the personal data you hold, and the provider acts as a data processor with a written agreement.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Where should my data physically sit in India?
India, by default, and you should be able to name the region. The DPDP Act 2023 restricts transfers of personal data outside India unless the central government has notified otherwise, and a customer asking where their data lives is exactly the question the Act exists to answer. Pick an India region for the primary workload, check whether support and telemetry can be constrained to the same geography, and check whether backups and disaster recovery replicas sit in the same region or a second one. Many providers replicate across regions inside the country by default and offer a single-region option; ask for it in writing.
What does the shared responsibility model mean in practice?
The provider secures the cloud: the hardware, the hypervisor, the physical datacentres and the managed services. You secure everything above that line: your accounts, identity configuration, firewall rules, data classification, encryption keys where you manage them, your applications and the people who have access. The dividing line runs through managed services, and it moves: a managed database handles patching of the engine, but you still own the roles, the network path and the data. Draw the line on a page for each service, write who is accountable for each layer, and treat any blank cell as a gap that needs an owner.
How do I know my cloud data is really protected?
Four checks, all evidence-based. First, confirm encryption at rest and in transit, and know where the keys live and who can use them. Second, confirm that storage is not publicly reachable and that the audit trail is on, with 180 days of retention exported to an account the workload admins cannot delete. Third, test the backup by restoring a sample into a clean environment and checking the data, because a backup that has never been restored is not a backup. Fourth, run an independent external cloud security assessment at least annually and after any major architecture change.
| Layer | Who is responsible | How you verify it |
|---|---|---|
| Hardware, datacentres, hypervisor | Cloud provider | Provider certifications and your contract |
| Account and identity configuration | You | IAM export and a privilege review |
| Network rules and public exposure | You | External scan and firewall rule review |
| Data classification and encryption keys | You | Key policy review and storage encryption check |
| Application code and API logic | You | Web application and API security testing |
| Backups and restore capability | You | Scheduled test restore into a clean account |
| Audit logging and evidence | You, with provider | Retention setting and log export check |
What are the frequently asked questions?
Get a straight answer on this
Send us your data inventory and cloud regions, and we will return a residency and encryption gap list for a CERT-In and DPDP review.
Send us the details See pricing