A contractual liability hiding in plain sight

The trigger was not a regulator’s letter. It was a renewal meeting. A multinational client of a mid-sized French legal-process outsourcing firm asked a straightforward question during contract renegotiation: can you demonstrate, in writing, that personal data we entrust to you never leaves European jurisdiction? The firm’s answer was honest and damaging. It could not.

The firm processed cross-border litigation data on behalf of roughly 800 corporate clients across the EU, handling document ingestion, OCR processing, and case management at scale. Its existing infrastructure mixed cloud regions in ways that were operationally convenient but legally opaque. As Schrems II enforcement tightened and enterprise legal teams grew more forensic in their due diligence, the gap between what the firm promised contractually and what it could actually prove became a material liability.

Three prospective mandates from multinationals had already stalled. Each organisation cited the same concern: without a verifiable attestation of data residency, their own data-protection officers would not sign off. The firm was losing business it had earned on merit, purely because it lacked the infrastructure to back up its commitments.

The compliance challenge in concrete terms

Legal data residency in the EU is not simply a matter of choosing a European cloud region. Post-Schrems II, the question is whether the infrastructure operator itself is subject to foreign jurisdiction. A European region operated by a US-headquartered hyperscaler remains exposed to instruments like the US CLOUD Act, which can compel disclosure regardless of where data physically sits. For a firm handling privileged litigation documents on behalf of corporate clients, that exposure is not theoretical; it is a contractual breach waiting to happen.

The firm’s workloads compounded the challenge. Document ingestion pipelines pulled in sensitive materials from multiple jurisdictions. OCR processing created derived data sets that carried the same sensitivity as the originals. Case-management records linked personal data to live legal proceedings. Every layer needed to be jurisdiction-locked, and the firm needed to produce auditable evidence of that fact, not just a vendor’s marketing claim.

Schrems II compliance in the legal sector is not a checkbox. It is a chain of custody question: who controls the infrastructure, under which law, and can you prove it in writing to a client’s DPO?

What DIVERSITY did and how

The firm engaged DIVERSITY to migrate its core processing workloads onto EU-only bare-metal infrastructure, hosted across DIVERSITY’s European datacenter footprint. Bare metal was the deliberate choice: dedicated physical servers eliminate the hypervisor layer and the multi-tenancy ambiguity that comes with it, giving the firm full control over the hardware stack and a clean answer to the question of who else might share its environment.

The migration was structured in three phases. First, document ingestion pipelines were moved to bare-metal nodes at DIVERSITY’s MAD1 facility in Madrid, chosen for its Southern European network position and its contractual alignment with EU law. OCR processing, which generates the largest transient data volumes, followed to dedicated nodes at MUC1 in Munich, where DIVERSITY’s finance and industry cluster provided the compute density the workload required. Case-management services, which hold the longest-lived and most sensitive records, were deployed across both sites with EU-only replication, ensuring that no failover or backup path touched infrastructure outside European jurisdiction.

DIVERSITY’s ISO 27001 certification and carrier-neutral status meant the firm could reference a single, auditable compliance framework rather than stitching together attestations from multiple vendors. DIVERSITY provided formal data residency attestations, contractually binding documentation confirming that all infrastructure, all replication paths, and all operational access remained within the EU and subject exclusively to European law. The firm could hand that documentation directly to its clients’ data-protection officers.

Architecture details that made the attestation credible

Credibility in a data-residency attestation comes from specifics. The firm’s clients were not going to accept a letter saying data stays in Europe; they needed to understand the controls that enforced it. Several architectural decisions made the attestation defensible under scrutiny.

  • All inter-site replication used DIVERSITY’s private backbone, with no transit over public internet paths that could route outside EU jurisdiction.
  • Operational access to the bare-metal nodes was restricted by contractual and technical controls to personnel operating under EU employment law, eliminating the support-access vectors that create CLOUD Act exposure on US-headquartered platforms.
  • BGP multihoming at both sites ensured network resilience without requiring failover to any non-EU point of presence.
  • Audit logs were retained on-infrastructure and made available to the firm for client-facing reporting, giving the data-protection attestation a live evidence base rather than a static declaration.

The firm’s internal security team worked alongside DIVERSITY’s engineers during the migration to validate each control before sign-off. The result was an architecture the firm’s own lawyers were comfortable putting their name to in client contracts.

What changed after migration

The immediate outcome was the resolution of the contractual liability that had triggered the engagement. The firm could now provide enterprise clients with jurisdiction-locked data residency attestations backed by auditable infrastructure evidence, satisfying the due-diligence requirements that its legal teams and data-protection officers demanded.

The three stalled mandates from multinationals that had declined to engage on data-protection grounds were reopened. All three converted. The firm’s ability to answer the data residency question cleanly had become a competitive differentiator rather than a vulnerability; in a sector where every firm claims to take data protection seriously, producing the documentation to prove it is a short list.

The migration also removed an operational dependency on infrastructure whose legal status required constant monitoring as Schrems II enforcement evolved. With EU-only bare metal as the foundation, the firm’s compliance posture is stable rather than contingent on the next regulatory development in transatlantic data transfer law. Its clients’ DPOs know where the data is, under which law, and how to verify it. That is what cross-border litigation data sovereignty looks like when it is built rather than claimed.