Ask a security vendor where their product runs and you get an answer about capability. Ask where your data is stored and you get a region list. Ask where your data is processed — analysed, correlated, acted on — and the conversation often changes character. In Southeast Asia, that third question is the one that determines what you can legally and practically deploy, which makes cross border data center compliance a boardroom question rather than a technical footnote.
When mapping out your regional cloud native security architecture, storing data in-country does not automatically mean processing it in-country. Multi-market buyers looking to satisfy strict data center localization requirements must verify vendor infrastructure paths, as broad global marketing terms frequently obscure offshore processing pipelines.
The finding that surprised us most
Across our latest research into AI and cybersecurity vendor capabilities in this region, AI capability and Southeast Asia operational fitness turned out to be weakly correlated — and in several categories, inversely correlated. The vendors shipping the most advanced autonomous AI features are frequently not the ones best positioned to deploy that AI inside the region’s data center localization requirements. Buyers evaluating one axis on the assumption it predicts the other are making a data-driven decision on data that doesn’t exist yet.
Two facts no datasheet tells you
The infrastructure picture across the region is starker than most buyers assume, and it doesn’t show up in a sales deck. Three of the six markets we cover — Thailand, Vietnam, and, until recently, the Philippines — have no evaluated vendor operating an in-country, cloud native security service at all. The other three don’t share that gap: Singapore hosts several vendor-operated cloud security services, and Indonesia and Malaysia each host at least one. The Philippines closed part of its gap quietly: Fortinet’s FortiSASE inventory now lists an in-country Manila data center, the first evaluated-vendor security infrastructure confirmed in that market. It’s a reminder that this map is not static, and that “underserved” is a snapshot, not a permanent verdict.
But the more consequential facts sit one layer beneath “where is it hosted,” and they concern processing, not just storage — the distinction regulators increasingly care about and vendor marketing rarely volunteers — and exactly where cross border data center compliance gets complicated. Here’s what that looks like in practice, based on a few vendor examples our latest research surfaced.
Storage is not processing. Microsoft’s own residency documentation confirms that Sentinel stores raw data in the customer’s chosen workspace region — which, following recent Azure launches, can now genuinely be in-country in parts of Southeast Asia — but processes that data in a United States region for any workspace located outside Europe, Israel, or China. An enterprise can accurately tell its regulator its telemetry is stored locally, while that same telemetry is analysed on another continent. Neither statement is false. The combination is simply never volunteered, and it’s exactly the kind of gap that turns a routine audit into an uncomfortable one.
A hyperscaler region is not necessarily a security region. Google Cloud’s new Bangkok region went live in January 2026, giving Thai organisations genuine in-country storage and processing for the first time — a real milestone for the country’s cloud native security architecture ambitions. What it hasn’t yet changed is the security layer: hosting general compute and AI workloads in-country does not mean any given vendor’s security service runs from that region too. Security vendors tend to lag hyperscaler infrastructure by years, not months. Thailand’s general-cloud gap closed in January 2026; its security-SaaS gap is still open, and Vietnam and the Philippines remain open on both counts.
Auditing Cross Border Data Center Compliance Requirements
Knowing where the processing happens is the first step. The second is knowing what that triggers procedurally — this is where cross border data center compliance stops being a technicality and starts being a filed regulatory requirement, and the three markets above don’t share one answer either.
This isn’t a “data in transit” technicality. Thailand’s own PDPC notifications carve out an exception for data merely passing through a system in transit, where no third party can access it — but that exception doesn’t cover a vendor actively analysing your telemetry on its own infrastructure abroad. That’s a third party accessing the data outside Thailand, which is a cross border transfer in substance, not a routing detail.
What this means for buyers is procedural, not exotic: depending on the market, this typically means executing Standard Contractual Clauses or Binding Corporate Rules, or filing a formal cross border transfer impact assessment, before the arrangement can be considered compliant. Which mechanism applies, and what counts as sufficient, is market specific and shifts as regulation matures — treat this as a prompt to check the current cross border data center compliance requirement with your data protection officer or legal counsel, not a substitute for that advice.
Sovereign identity: the layer that isn’t sovereign anywhere
One gap in the regional map has no current answer at all. Organisations in Southeast Asia can today deploy sovereign, in-region infrastructure for their endpoint platforms and their network security stacks. They cannot do the same for identity. Not one evaluated vendor — large multinational platform or local specialist — offers in-region identity infrastructure anywhere in Southeast Asia. The system that holds the keys to everything else is, structurally, the one layer that has to live abroad. Third-party residency overlays exist for identity, and we cover them separately, but the structural finding stands on its own: this is the clearest unserved market our research identified, in any category, in any of the six markets we cover — arguably the single largest unresolved cross border data center compliance exposure in the region.
What we’re not putting in a blog post
We did map every evaluated vendor onto a three-tier deployment taxonomy — cloud-only, vendor-operated in-country region, and customer or partner-hosted sovereign deployment — and scored each one against it. That’s deliberately not a public-post exercise. Knowing that the gaps exist is a planning input; knowing exactly which sovereign cloud security services clear which bar, in which of the six markets, at what evidence grade, is a procurement input — and it’s the kind of finding that belongs in a document you can put in front of a CFO or a regulator, not a page a competitor can screenshot.
That full taxonomy, scored against every vendor across every category — EDR/MDR/XDR, SIEM/SOAR, SASE, exposure management, and identity — sits in our upcoming AI and Cybersecurity in Southeast Asia Q3 2026 — Vendor Intelligence report, alongside the verification register behind every claim in it. It will be linked from our reports page the moment it’s live — expected in August 2026. In the meantime, if you’re building the case for cross border data center compliance now rather than waiting until August, our existing AI and Cybersecurity in Southeast Asia Q2 2026 report covers all six markets in depth, including the regional incident and breach-cost data behind the urgency — APAC accounts for 34% of global cyber incidents, and the average ASEAN breach now runs to USD 3.67 million — along with recommended actions broken out by role, for the CISO, technology leaders, and risk officers. It’s available today.
Where this leaves a buyer today
Treat cross border data center compliance as a moving target: every hyperscaler region announcement in this region is the start of a multi-year clock for security services, not the end of a compliance constraint. Ask your vendor the processing question, not just the storage question — and get the answer in writing. And if identity is the system you’re least willing to compromise on, start that conversation now: sovereign cloud security services haven’t reached that layer yet, anywhere in Southeast Asia, as far as our research found.
This is one finding from a broader cross border data center compliance research programme into AI-era vendor capability across the region. For the full picture — deployment taxonomy, evidence grading, and market-by-market guidance — see our reports, or the rest of our insights, including our earlier look at how cross border data sovereignty compliance is reshaping the region alongside ASEAN’s AI governance agenda.
Sources: Google Cloud, “Sawasdee Thailand! Google Cloud launches new region in Bangkok” (January 21, 2026). Microsoft Learn, Microsoft Sentinel: geographical availability and data residency. Thailand PDPC cross border transfer notifications under PDPA Sections 28 and 29 (effective March 24, 2024), summarised via Tilleke & Gibbins.
