Phone System Data Residency: Where Your Calls and Data Live

Tom Reed · Updated 21 October 2026

Data residency means the country or region where your phone system's data is hosted and processed. For a hosted phone system that covers call records, voicemail, recordings, chat history and contacts, but not the calls your SIP carrier carries and bills. Pick a hosting region near your team, ask the provider the questions below in writing, and check the ICO's guidance for your UK GDPR duties.

This is a practical playbook for small businesses running, or about to choose, a hosted phone system. It isn't legal advice. Where the law comes up, we point to the Information Commissioner's Office (ICO), the UK regulator, rather than tell you what applies to your business. SessionPBX is used as the worked example, and its Teams Phone and Teams Business plans are SessionPBX plans, not Microsoft Teams.

What does data residency mean for a phone system?

Data residency is about location: which country or region your data sits in, and where it's processed. For a traditional office phone system, the answer was simple. The box was in your comms cupboard, so the data was too. With a hosted phone system, the PBX runs in a provider's data centre, so "where is my data?" becomes a question you have to ask. Our guides to the PBX phone system and the cloud-based phone system explain how the hosted model works.

VoIP data residency also has more moving parts than most software. A single customer call can touch several places:

• The hosted phone system, which routes the call and keeps the call history, voicemail and any recording.
• The apps on your team's devices, which show call history, chat and contacts, and may hold downloaded files.
• Your SIP carrier, which connects the call to the outside world and keeps its own records for billing.
• Other systems you connect, such as the email inbox where voicemail notifications land.

So "UK data residency" for a phone system isn't one setting. It's a map of what data exists, where each copy lives and who holds it.

Three terms are worth keeping apart:

• Data residency is where the data is hosted.
• Data sovereignty is whose laws apply to the data, which can depend on more than location.
• Data protection is how personal data is handled: why you collect it, how long you keep it, who can see it and how it's secured.

Residency is only one input to data protection. A phone system hosted close to you can still be set up badly, and good handling still matters wherever the data lives.

Which phone system data should you map?

Before you ask a provider anything, list what your phone system actually creates. Most small businesses find more data than they expected, because calls generate records even when nobody presses record.

Phone system data map

Use this as a starting template. The "who holds it" column is generic; fill it in for your own provider and carrier.

Two rows catch people out. Voicemail often ends up in two places: the phone system and your email. On SessionPBX, for example, you can "listen to and download voicemail in the portal" and "receive new messages by email with the recording attached". That email copy lives wherever your email is hosted, not where your phone system is hosted. Our guide to business voicemail setup covers the settings to review.

Recordings are the other. Once someone downloads a recording to a laptop or shares it by email, that copy has its own location. If you record calls, read our guide to softphone call recording compliance for the notice and consent side, which this post doesn't repeat.

What questions should you ask a hosted phone system provider?

Ask these in writing and keep the answers with your supplier records. A good provider will answer plainly or point you to a document that does. If an answer is vague, ask again.

Provider questions checklist

1. Hosting regions. Which regions do you host in, which one will our phone system be in, and can we choose?
2. Backups. Where do backups live, and are they in the same region as the live system?
3. Retention. What are the retention periods for call history, voicemail, recordings and chat, and who sets them, you or us?
4. Export and deletion on exit. If we leave, how do we export our data, in what format, and how is it deleted afterwards?
5. Sub-processors. Which other companies process our data for you, and where are they located?
6. Encryption. What do you use for encryption in transit and at rest, and which data does each cover?
7. Access to recordings. Who on your side can access our recordings or voicemail, and in what circumstances?
8. Data processing agreement. Do you offer a data processing agreement (DPA), and where can we read it?

Some answers will be on the provider's website and some won't. Where a public page doesn't cover a question, ask support and get the reply in writing. Don't assume an answer because a page is silent.

Two of these questions overlap with security. For the wider list of controls, such as admin access, multi-factor sign-in and fraud protection, use our cloud PBX security checklist. This post sticks to location and handling.

The exit question deserves extra care. When a person leaves, their chats, voicemail and call history don't disappear on their own. Our phone system leaver checklist covers what to remove or hand over for one person. Ask the provider how the same works for your whole account if you ever move.

How do you choose a hosting region for your team?

For most small businesses, the hosting region choice is simpler than it sounds. Start with where your people are, then check whether anything in your business points elsewhere.

Start with your team's location. Calls and messages have to travel between your team's devices and the hosted phone system. Hosting close to the people who make and take calls keeps that path short. A UK team will usually want a UK region; a team in New York will usually want a US one.

Then check your customers and contracts. Some customer contracts, tenders or sector rules say where data must be held. If yours do, that decides the region, whatever is technically quickest. Ask your customers or your adviser, not the phone system provider, what those obligations mean for you.

Then think about split teams. If you have staff in more than one country, ask the provider how it handles one account with people in different places. Ask which region your account sits in and what that means for the people furthest away.

Write the decision down. Record which region you chose or were given, why, and the date the provider confirmed it. That note helps when a customer, auditor or new manager asks.

A practical sequence:

1. List where your team works and where your main customers are.
2. Check contracts and tenders for any data location wording.
3. Ask the provider which regions it offers and which one your phone system will be in.
4. Confirm the answer in writing, including where backups live.
5. Note the decision in your supplier records and review it if your team or customers change.

If you're comparing providers on a trial, add the region question to your trial notes. Our hosted PBX free trial checklist has a section for supplier questions you can extend.

What stays with your SIP carrier, not the phone system?

A hosted phone system with bring-your-own SIP trunk has two suppliers holding call data: the phone system provider and the carrier. Your data map isn't complete until you include both.

Your SIP carrier is the company that connects your calls to the public phone network. With a bring-your-own SIP trunk model, you have a direct account with that carrier. That means the carrier keeps its own records under its own terms:

• Call detail records for every external call: the numbers involved, the time and the duration.
• Your phone numbers and the account details attached to them.
• Billing records, because the carrier bills you for numbers and calls.
• Account and contact details for the people who manage the account.

None of that sits in your phone system provider's hosting region by default. The carrier decides where it holds its records, so check its terms and ask it the same questions: which region, how long, sub-processors and export.

Internal calls are different. On SessionPBX, "internal team calls are included" and "team-to-team calls never leave our network", so calls between colleagues don't go through your carrier. Only external calls do.

Your SIP trunk credentials are a special case. They sit with the phone system so it can connect to your carrier, and anyone who gets them could make calls on your account. Our guide to VoIP toll fraud prevention covers how to protect them. For what to look for in the carrier itself, including the questions about terms and support, see our guide to choosing a SIP trunk provider for a hosted PBX. We don't recommend or rank particular carriers.

What do UK GDPR and the ICO expect?

This section points you to the regulator. It isn't legal advice, and your obligations depend on your business, your customers and how you use your phone system. If you're unsure, take advice.

The ICO publishes guidance for UK organisations. Three pages are most useful for GDPR data residency questions on a phone system:

• International transfers. The ICO's brief guide to international transfers explains that the UK GDPR has rules about sending or making personal information accessible to organisations outside the UK, and includes checklists for identifying a "restricted transfer". Read it if any copy of your phone data, or any sub-processor, sits outside the UK.
• Storage limitation. The ICO's guidance on the storage limitation principle says you must not keep personal data for longer than you need it, and that you should be able to justify how long you keep it. That's why the retention question in the checklist matters for call history, voicemail and recordings.
• Security. The ICO's guide to data security covers the security principle, including the security requirements that apply to any processor you use and what your written contract with them should require.

Notice what these pages are about. Residency is one fact you need. The ICO's guidance is mostly about how data is handled: transfers, retention, security and contracts. Knowing where your data lives is the start of that work, not the end.

If your business operates in the US, the ICO's guidance won't be the right source. Check state and sector rules that apply to you, and take advice where you need it.

Hosting regions on SessionPBX

Here's how SessionPBX answers the hosting question on its own page. SessionPBX is hosted in the UK (London), the US (New York) and Singapore. Your phone system is hosted in the region closest to your team to reduce call setup and messaging delays. The page adds that "the admin portal, setup process, and softphone experience are consistent across regions", so the apps your team uses are the same wherever the phone system is hosted.

On security, the page says "SIP signaling, messaging, and the admin portal all use TLS by default", and that "your SIP trunk usernames and passwords are stored encrypted at rest with AES-256-GCM". It also describes "IP access controls and automated blocking" against repeated login attempts and suspicious traffic.

For the other questions in the checklist, such as backups, retention and sub-processors, ask SessionTalk support directly and keep the reply with your records. We haven't covered them here because the hosted PBX page doesn't.

SessionPBX is fully hosted and managed, with native apps for Windows, macOS, iOS and Android. Teams Phone covers "everyday calling, messaging, voicemail, team contacts and app provisioning, with SIP trunks for external calls." Teams Business adds ring groups, call queues, visual call flows, recording and supervision. Teams Phone and Teams Business are SessionPBX plans, not Microsoft Teams.

SessionPBX is bring-your-own SIP trunk: "external calls use your own SIP carrier, which bills you directly for numbers and calls." SessionPBX doesn't supply numbers or lines, so your carrier's records stay with your carrier, as described above. Both plans include a 14-day free trial, with no setup fee or long-term contract. See the hosting regions and plans on the SessionPBX hosted PBX page.

FAQ

Is data residency the same as GDPR compliance?

No. Data residency is where your data is hosted. Compliance is about how personal data is handled: why you hold it, how long you keep it, how it's secured and who it's shared with. The ICO's guidance covers the handling side. Hosting in a particular region doesn't on its own make a phone system compliant.

Does UK data have to stay in the UK?

The UK GDPR has rules on transferring personal information outside the UK, and the ICO's brief guide to international transfers explains when they apply. Whether they affect you depends on your situation, so read the guidance and take advice if you're unsure. This isn't legal advice.

Where are call recordings stored on a hosted PBX?

It depends on the provider. Ask where recordings are stored, whether backups are in the same region, how long recordings are kept and who can access them. Remember that any downloaded or emailed copy lives wherever it was saved.

Does my SIP carrier also hold call data?

Yes. Your carrier keeps call detail records, your numbers and billing records under its own terms. Check where the carrier holds that data and ask it the same questions you ask your phone system provider.

Where is SessionPBX hosted?

SessionPBX is hosted in the UK (London), the US (New York) and Singapore, and your phone system is hosted in the region closest to your team.