Where your engagement data should live, and how to defend the answer

A penetration testing report is an inventory of the fastest ways into a client’s business, written by experts, in order of exploitability. Very few documents your client owns are worth more to an attacker. It is worth being deliberate about where that document lives between the day you write it and the day they read it.

The question behind the question

When a client asks where their data is stored, they are almost never asking for a city. They are asking three things at once: who could read this if they wanted to, what happens if that party is compromised, and can we prove any of it to our own regulator. A city name answers none of them, which is why "hosted in the EU" so often produces a follow-up email rather than a signature.

Answer the three directly instead. Name who holds custody. Name what would have to be compromised for a third party to read a finding. Name the artefact you can hand an auditor. If your answer to any of those is "the vendor says so", you have inherited their risk posture and you will be defending it in your own client’s procurement review.

Custody is not the same as location

Two arrangements can both put data in London and be very different. In the first, a vendor holds your findings in a database they administer, in a London region, alongside every other customer’s. In the second, the database is in your own cloud account, in London, and the vendor has no standing route into it. The pin on the map is identical. The set of people who could read the report is not.

Custody is the question that actually determines your exposure, and it is the one a shared-tenancy platform cannot answer in your favour, because the honest answer involves their staff, their access reviews and their incident history rather than yours.

A useful test: if the vendor went out of business on Friday, could you still open a report on Monday without asking anyone? If not, they have custody and you have a dependency.

Residency, and when it genuinely matters

Data residency is over-invoked and under-specified in this industry. It matters concretely in a few situations, and being able to tell them apart saves a lot of argument.

• The client is a public body, or supplies one, and its own contract fixes a jurisdiction it can process in.
• The engagement scope includes systems holding special-category personal data, where a transfer mechanism has to be named rather than assumed.
• The client operates under a sector rule, common in finance and health, that constrains where records of a security assessment can sit.
• The client is in a jurisdiction with a data-localisation statute, in which case this is settled law rather than a preference.

Outside those, residency is usually a proxy for the custody question above. Clients ask it because it is the question they have a word for. Answering the real one tends to end the thread.

What to write into your own contracts

Whatever you decide, put it in the engagement letter rather than leaving it to be discovered during an incident. The clauses worth having are short:

• Where the report and its evidence are stored, named as an account and a region rather than a brand.
• Who at your firm can read it, and how that is enforced rather than promised.
• How long you retain it after delivery, and what the client can require you to destroy.
• What happens to it if the client leaves, and how quickly.
• Which sub-processors touch it, including any AI provider, and under whose account.

That last one has become the sharp edge. A firm that has quietly routed client findings through a vendor’s AI account has added a sub-processor to every engagement it has run since, usually without telling anyone, and often without being able to say what the retention terms are.

A short checklist before you answer a client

None of this requires you to run your own infrastructure. It requires you to know which questions have architectural answers and which have only promises, and to be honest with your client about which is which. That distinction is most of what buying trust looks like in this market.