Multi-region trade-offs

More regions buy resilience and residency reach, and they cost consistency, latency, and operational complexity. Key points:

• Be explicit about the data layer. State which data is regional, which is global, and how the tenant isolation guarantee holds across regions.
• Name the trade-off for each choice: active-active versus active-passive, synchronous versus asynchronous replication, single-region data residency versus multi-region availability. There is no free option, only the one that fits the constraints.
• Resilience that breaks isolation or makes the audit trail unprovable is not resilience. The security guarantees are the constraint the design works within, not a dial you turn down for uptime.