Data Residency for a Long-Term NetSuite Archive: What to Ask Before You Choose Where It Lives

A NetSuite archive is often kept for longer than the ERP was used, and residency rules follow the data for that whole period. This post is for the security, compliance and procurement reviewers who have to approve where a retired account's history will be hosted: what to establish before choosing a region, which controls to ask a vendor to evidence, and how to keep the data movable if the answer changes.

September 28, 2026 6 min read Audit & Compliance

Three people in a monitoring room in front of screens showing world maps

Retention periods for financial and tax records commonly run for years after the system that produced them is switched off, and the archive is the copy that has to satisfy every rule in force during that time. A region chosen for convenience in the week the account closes can become the question a regulator, an auditor or a customer's procurement team asks about in year five.

Where must our NetSuite archive be hosted?

That depends on the data and the entities, and it is a question for your legal and compliance advisers rather than for a vendor. Some rules restrict where certain categories of personal data may be stored or processed. Others, such as Chapter V of the EU General Data Protection Regulation, set conditions on transferring personal data outside the jurisdiction. India's Digital Personal Data Protection Act is covered in a separate post. Establish three things before choosing a region:

Which entities' records are in scope, and which jurisdictions' rules each one is subject to.
What personal data the archive will hold: employee records, customer contacts and addresses, and personal details inside attachments are the usual examples.
How long each category must be kept, so the hosting decision covers the whole period rather than the first year.

If group entities are subject to different rules, say so during scoping. The hosting region is agreed for the engagement, and an archive can be provisioned in a nominated region where residency is a requirement.

What should a security review ask an archive vendor to evidence?

A residency answer is only as good as the controls around it. For a long-term archive, ask for the control, its scope and how it is evidenced, not for adjectives. For DBVault, the answers are these:

Hosting and isolation: the platform runs on Amazon Web Services with network isolation, and production databases and infrastructure access are protected from the public internet.
Encryption: customer data is encrypted at rest, and data in transit is protected with TLS.
Access to the archive: read-only viewer roles restricted by archive, record type, File Cabinet folder and subsidiary through named restriction profiles; sign-in with multi-factor authentication, with single sign-on available; logins and downloads logged.
Separation: each archive is a relational database with its own schema, so a group that retires several accounts keeps each one's records apart under one set of access rules.
Backups: relevant data is backed up regularly, and the integrity of the backups is verified and periodically tested.
Assurance: Blueacrobat is ISO/IEC 27001:2022 certified and SOC 2 Type II audited, and the controls are published in the Trust Centre.

These controls support a residency and retention policy; they do not make an organisation compliant on their own. Whether a configuration meets a specific obligation still depends on the law, the data, the contract and the organisation's own procedures.

Keep the data movable

Rules change over a long retention period, and so do group structures and vendors. The archive should not become the only place the data can exist. When a NetSuite account is extracted through AcroXtract, the extraction is delivered to you as a MySQL database snapshot and a zip of the database and the File Cabinet, and hosting on DBVault is optional. Inside DBVault, every list exports to CSV and snapshots can be taken, so the history can follow a later change of region or provider.

A short checklist before the account closes

List the entities in scope and the residency rules each is subject to, with your legal adviser.
Identify the personal data categories the archive will hold, including inside attachments.
Agree the hosting region for the whole retention period, and record why it was chosen.
Obtain the vendor's certification and examination evidence, and map the controls to your policy.
Decide who will administer access, and which roles auditors and former staff of divested entities will get.
Confirm how the data leaves the archive if the region, the vendor or the rules change.

If your review needs the hosting and control details for a specific account before it can approve an archive, bring the entities in scope and the residency requirement to a conversation, and see how DBVault for NetSuite is hosted and controlled.