European Bank: Data Residency and Private Connectivity for watsonx.data
Rheinland Bank is a Frankfurt-based institution with 12 TB of transaction and reference data. It wants to use watsonx.data for Presto analytics but must keep all data and metadata in the EU, avoid public internet paths, and integrate with its on-premises Db2 and Hive metastore. Thirty analysts will query curated Iceberg tables. The bank requires customer-managed encryption keys, quarterly key rotation, and network evidence for auditors. A SaaS watsonx.data option is available in an EU region; a self-managed deployment on Cloud Pak for Data is also possible. The network team can provide IBM Cloud Direct Link and private endpoints, but only after a design review. The security team will not approve long-lived database credentials in connection definitions. The bank needs a decision on deployment model, connectivity, and key management before a six-week pilot. Cost is secondary to compliance, but the pilot must not require a new data center.
1. How would you choose between SaaS watsonx.data in an EU region and a self-managed deployment on Cloud Pak for Data?
Read the worked answer
Decide on evidence, not preference. SaaS: acceptable only if the service region, control plane, backups, logs, and support access all meet the EU residency requirement; if private endpoints and Direct Link are supported for the needed services; if customer-managed keys and the required rotation are available; and if the bank's IAM and audit exports integrate. Verify these in writing during the design review. Self-managed: gives more control over network and key custody but creates operational burden and may require infrastructure the bank does not have in the six-week window. Decision rule: if SaaS meets residency, private connectivity, BYOK, and audit requirements, use it for the pilot; otherwise use self-managed only if the bank can operate it without a new data center. Do not treat data residency as only the data bucket: metadata, query history, backups, and support access are in scope. Run a short proof with the auditor present before committing production.
2. Design the connectivity and key-management controls for the pilot.
Read the worked answer
Connectivity: use IBM Cloud Direct Link from the bank network to the IBM Cloud VPC, private endpoints for object storage and watsonx.data services, and private DNS. Deny public endpoints and test the denial. Restrict security groups and network ACLs to the ingestion and analyst subnets. Connect to on-premises Db2 over the private path with TLS and a read-only service account whose credential is fetched at runtime from a secret manager, not stored in a connection definition. Keys: use IBM Key Protect or Hyper Protect Crypto Services with a customer-managed root key; separate keys per environment; restrict key-rotation and decrypt permissions to a small security group. Enable encryption for data at rest and in transit. Separation: pilot analysts get a dedicated group and engine; ingestion uses a separate credential and network path. Evidence: keep the network diagram, endpoint inventory, key policy, and rotation record. The design must show that no required path traverses the public internet.
3. What evidence would you give auditors to prove residency, private connectivity, and key custody before production?
Read the worked answer
Provide a control-to-evidence mapping. Residency: the contracted service region, bucket and catalog locations, backup location, log retention location, and a written statement that support access follows EU procedures. Private connectivity: the Direct Link order, VPC and private-endpoint inventory, security-group rules, DNS configuration, and a test showing public access is denied from an analyst workstation. Key custody: the Key Protect or HPCS instance, customer root key ID, key policy showing the bank controls rotation and revoke, and a rotation test record. Access: IAM group mappings, the pilot access matrix, and sample audit logs showing user, query, and table. Pilot acceptance: a signed checklist from security and audit, plus a rollback plan. Do not rely on vendor marketing language; each claim needs an artifact the auditor can inspect. If any artifact is missing, the pilot should not be declared complete.