Residency is not the same as sovereignty
A foreign provider can run a datacentre region in India, so the data is resident here, while the company that controls it is subject to its home country's law as well. Sovereignty asks the second question too: which legal entity holds the data, and which courts and regulators can compel it.
BookMyHost is run by an Indian private limited company with a GSTIN. The servers, the network (AS152523, peered at Extreme IX) and the Noida datacentre are Indian, so the data stays under Indian jurisdiction only. See India cloud.
What the Indian rules ask
- DPDP Act 2023: it governs how personal data is processed and lets the government restrict transfers to notified countries. Processing in India on an Indian entity keeps cross-border transfer questions out of the picture; compliance still depends on how your application handles personal data.
- CERT-In directions of April 2022: cloud and VPS providers must verify their customers, keep logs for 180 days and report cyber incidents. That is why every account here completes eKYC before its first deployment.
- RBI storage of payment system data: payment system operators must keep that data only in India. A server in an Indian datacentre meets the location part; your own controls cover the rest.
- Sector rules: banks, insurers and government projects can have their own outsourcing and residency rules, so check with your compliance team.
What to check with any VPS provider
- Where the primary servers, snapshots and backups are stored, and whether anything is replicated abroad.
- Which legal entity signs the contract and issues the invoice, and in which country it is registered.
- Whether support staff outside India can access your data.
- Whether the provider runs its own network, or depends on another company's routing and abuse policy.
- Whether a data processing addendum is available.
How BookMyHost answers them
- Servers, snapshots and S3 Advance object storage stay in the same Indian region; there is no cross-border replication and no offshore backup.
- The contract and the GST tax invoice come from the Indian company, in rupees.
- Support is run from India; no foreign support desk has access to your data.
- The network is its own autonomous system, with DDoS scrubbing by Cloudflare Magic Transit.
- A data processing addendum is available on request from support@bookmyhost.com.
Regions
Noida (Delhi NCR) is live today; Mumbai and Chennai are coming at the same rate card. Typical round trips from Noida are ~25 ms to Mumbai, ~30 ms to Hyderabad and ~35 ms to Bengaluru, so one Indian region serves the whole country. See locations.