Your CISO reviews the quarterly identity audit for the claims platform. Every sign-in log lists an Australian region code, yet the session tokens carry US-issued certificates that never hit the local key store.
The vendor contract lists data residency as a configuration toggle. Once the platform routes any high-volume workload through the shared auth service, the toggle stops applying to refresh tokens and assertion signatures.
Procurement accepted the lower per-user fee that came with global scale. The legal team never saw the clause that lets the vendor re-home token validation to the nearest available node during peak load.
Security operations now fields weekly alerts when Australian customer records trigger US jurisdiction subpoenas because the token metadata includes the issuer's primary region string.
The board risk committee still sees green status on the residency dashboard. The metric only counts where the user directory lives, not where the cryptographic material that proves identity is generated and signed.
A single integration sprint with the new claims partner exposed the gap. Their API rejected the Australian-issued tokens outright because the certificate chain traced back to a non-resident root.
Fixing it requires ripping out the federated trust bundle and standing up a local authority that every downstream system must re-onboard against. The original contract prices that work as a full re-implementation.
Until the next renewal, every new partner integration carries an unpriced residency exception that lands on the security team rather than the vendor.