Communication Services: Issues with Azure Communication Services Email in Canada — Clarification on Data Residency and Processing

Question

Problem descriptionI am evaluating Azure Communication Services (ACS) Email for a Canadian healthcare application and require clarification regarding Canadian data residency and transient processing before determining whether the service is appropriate for production use.When an ACS Email resource is configured with Data Location = Canada, can Microsoft confirm:Are email bodies and attachments processed exclusively within Canada throughout the complete email-delivery lifecycle?Can transient operations—including queuing, malware/security scanning, retry handling and failed-delivery processing—occur outside Canada?If processing can occur outside Canada, which countries, Azure geographies or geographic regions may be involved?If an attachment is encrypted by the application before submission to ACS Email, and Microsoft is not provided the decryption password/key, would Microsoft systems involved in processing have access only to the encrypted attachment rather than its underlying contents?Is there any ACS Email configuration, service tier or contractual commitment that guarantees email content and attachments remain exclusively within Canada for both storage and transient processing?EnvironmentAzure Communication Services Email

Data Location: Canada Intended use: Canadian healthcare applicationWhat I've already triedI have reviewed the public Azure Communication Services privacy/data-residency documentation and have also contacted Microsoft Support.My understanding from the information received so far is that data stored at rest can be associated with the selected geography, but the available documentation does not provide an ACS Email-specific guarantee that all transient processing remains within Canada.I have also been unable to find documentation identifying the geographic locations in which transient ACS Email processing may occur.Current statusI need an authoritative clarification regarding the above before completing a healthcare privacy/security and vendor assessment.If ACS Email cannot guarantee Canada-only transient processing, confirmation of that limitation would also answer the question.Links to any applicable Microsoft documentation, contractual commitments, Data Protection Addendum provisions, or ACS Email-specific data-residency documentation would be greatly appreciated.

Answer 1

Hello @Nicole Welsh

Welcome to the Microsoft Q&A and thank you for reaching out.

Thank you for your detailed questions regarding Azure Communication Services (ACS) Email and data residency for your Canadian healthcare application.

Based on the available Microsoft documentation and the additional clarification obtained from the Azure Communication Services engineering team, your overall understanding is correct.

When an Azure Communication Services resource is configured with Data Location = Canada, the selected geography determines where applicable Communication Services data stored at rest is retained. However, this does not provide assurance that the complete ACS Email processing lifecycle occurs exclusively within Canada.

Microsoft documentation states that Azure Communication Services data may transit or be processed in other geographies as part of providing the service. For an ACS resource configured with Data Location = Canada, we have additionally confirmed with the engineering team that the email request may be processed outside Canada and is likely to be processed in the United States.

Therefore, the Canada data-location selection should not be interpreted as a guarantee that email bodies, attachments, or all transient email-processing operations remain exclusively within Canada throughout the complete delivery lifecycle.

Regarding logging and telemetry, the engineering team also confirmed that ACS Email internal service logs do not contain PII. However, customer-accessible ACS Email logs can contain PII or recipient-related information. For example, recipient-level Email Status Update logs can include the recipient email address.

For your scenario involving password-protected or application-encrypted attachments, using encryption before submitting the attachment to ACS Email can provide an additional layer of protection. However, this does not change the documented ACS data-residency and processing boundaries described above.

Based on these findings, ACS Email does not currently provide assurance that the entire email-processing lifecycle, including transient processing, remains exclusively within Canada. This distinction should be considered as part of your organization's privacy, security, and regulatory assessment.

For reference, the following Microsoft documentation provides additional information:

• Azure Communication Services - Data residency and user privacy:

https://learn.microsoft.com/en-us/azure/communication-services/concepts/privacy

• Azure Communication Services - Email logs:

https://learn.microsoft.com/en-us/azure/communication-services/concepts/analytics/logs/email-logs

• Azure Monitor - ACS Email Send Mail operational log schema:

https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/acsemailsendmailoperational

I hope this clarification provides the technical information required for your organization's privacy and security assessment.

If this answer has addressed your questions and provided the clarification you were looking for, kindly consider accepting it as the answer. This will help other members of the community who may have similar questions in the future.

Thank you