Cloud Compliance Without the Jargon

Shared responsibility, certifications and data residency explained in terms of what you actually have to do.

2 July 2026 3 min read

Compliance conversations get tangled because two different things are called the same thing: the provider’s compliance, and yours. They overlap far less than people assume.

Shared responsibility, concretely

Layer	Who is responsible
Physical data centre security	Provider
Hypervisor and host patching	Provider
Network backbone	Provider
Guest operating system patching	You (except on managed services)
Application code and dependencies	You
Identity and access configuration	You
Data classification and encryption choices	You
Firewall and network rules	You
Backup and recovery	You

The share moves with the service model. On a virtual machine you own the OS; on a managed database you do not; on a serverless function you own almost nothing below your code. Know which line applies to each workload.

What a provider certification means

When a provider says it is ISO 27001 certified or SOC 2 audited, that covers the infrastructure and the provider’s own processes. It does not make your application compliant, and it does not transfer to you automatically.

What it does give you is the ability to inherit controls: you can point to the provider’s report for the physical and infrastructure layers, and produce your own evidence only for the layers you own. That is a genuine reduction in work, and it is the real value.

The frameworks you will meet

SOC 2 — a report on controls around security, availability, confidentiality. Commonly requested by enterprise customers.
ISO 27001 — a certified information security management system. International, audited, renewed.
GDPR — European data protection law. Not a certification; an ongoing legal obligation about personal data.
HIPAA — US healthcare data. Requires a Business Associate Agreement with the provider.
PCI DSS — card data. Scope reduction is the main strategy; do not store card numbers if you can avoid it.

Data residency in practice

Residency requirements are about where data physically rests. Three things follow:

Choose regions that satisfy the requirement before you build, because moving later means recreating resources.
Check backups and replicas as well as the primary. A compliant primary with a replica outside the boundary still breaches it.
Check managed services individually — some replicate metadata or logs to a home region by default.

Choosing a cloud region covers the mechanics of that decision.

Making an audit survivable

Auditors ask for evidence, not intentions. Producing it is much easier if you set it up in advance:

Audit logs retained for the required period, in a place nobody in production can delete.
Access reviews performed on a schedule, with the results recorded.
Change records — infrastructure as code in version control is close to ideal here.
Encryption settings demonstrable through configuration rather than assertion.
Backup tests with dates and outcomes written down.
Onboarding and offboarding records showing access granted and removed.

Infrastructure as code plus an audit log covers a surprising share of what gets asked for.

Where the providers differ

The hyperscalers hold the broadest certification catalogues and publish region-by-region compliance mappings. IBM Cloud and Azure offer sector-specific programmes for financial services. Smaller providers hold fewer certifications, which does not make them less secure — it makes inheriting controls harder, and shifts more evidence production onto you.

If a customer contract names a standard, check the specific provider and the specific region against it before committing.

Common questions

Does using a compliant provider make us compliant?

No. It covers the layers they operate. Your configuration, code, access control and processes are still yours to evidence.

Do we need a Data Processing Agreement?

Under GDPR, if the provider processes personal data on your behalf, yes. All major providers publish standard terms you can accept.

Is a VPS provider disqualified by fewer certifications?

Not automatically. It depends on which standard applies and what you can evidence yourself. For regulated workloads with named requirements, a hyperscaler usually reduces effort substantially.

How do we reduce PCI scope?

Do not handle card data directly. Use a payment provider’s hosted fields or redirect so card numbers never touch your systems. This is the single largest scope reduction available.

Where to go next

See audit logging and choosing a cloud region, the two areas compliance questions most often land on.

AWS IBM Cloud Microsoft Azure