Self-Hosting Your GTM Stack: A Compliance Playbook for BFSI and Healthcare

India's Digital Personal Data Protection Act (DPDPA), RBI's data localization requirements, and HIPAA in the US share a common implication for sales tooling: if your team's prospecting data contains personal information about residents of these jurisdictions, that data may not legally leave the country. For most GTM platforms, which are cloud-only and hosted on US infrastructure, this is a hard blocker.

What counts as "personal data" in a GTM context

The regulation-specific definitions vary, but in practice any of the following trigger data residency requirements:

• Individual contact names and work email addresses
• LinkedIn profile URLs or any social identifier
• Phone numbers, direct dials, or mobile numbers
• Any enrichment data that combines these fields with company affiliation

Company-level data (firmographic data about a company as an entity, without individual contact information) generally falls outside personal data definitions. But the moment you add a contact name to a company record, you've created a personal data record under DPDPA.

The architecture of a compliant self-hosted deployment

A minimal compliant deployment has three components:

1. Compute layer: A Kubernetes cluster in an in-country data center. For India, this means Mumbai or Hyderabad regions on AWS (ap-south-1 or ap-south-2), Azure (Central India), or GCP (asia-south1). For UAE, use UAE North. For Singapore, ap-southeast-1.
2. Database layer: PostgreSQL with pgvector for semantic search, deployed in the same region as compute. All prospect records, contact data, and interaction history live here. External database connections (to cloud-hosted postgres) are acceptable if the external postgres is in the same jurisdiction.
3. AI inference layer: This is the hard part. If your GTM platform calls OpenAI or Anthropic APIs with prospect data as context, that data is leaving your jurisdiction. You need either a local model deployment (Llama 3, Mistral, or similar on your infra) or a regionally-compliant API endpoint. AWS Bedrock in ap-south-1 qualifies for India.

What Zonarity's self-hosted deployment looks like

The Helm chart configures all three layers with a single values file. The key settings for a compliant India deployment:

dataResidency:
  region: ap-south-1
  enforceLocalInference: true
ai:
  provider: bedrock  # or local-llm
  bedrockRegion: ap-south-1
  disableExternalCalls: true
postgres:
  external: true
  host: your-rds-instance.ap-south-1.rds.amazonaws.com

With enforceLocalInference: true and disableExternalCalls: true, the platform will refuse to make any outbound API calls that would send personal data outside the configured region.

Operational considerations

Model updates: Self-hosted models don't auto-update. You need a process for pulling updated model weights and redeploying. We recommend a monthly cadence with a staging environment to test quality regressions before production rollout.

Monitoring: Standard cloud GTM platforms include built-in usage analytics. In a self-hosted deployment, you own the observability stack. Prometheus + Grafana covers most operational metrics. For audit logging (required under DPDPA for data access), ship logs to an immutable append-only store — S3 with Object Lock works well.

Support SLA: This is the tradeoff most compliance teams underestimate. When a cloud vendor's system goes down, you call support. When your self-hosted deployment goes down, your team fixes it. Factor in the operational overhead — typically half a DevOps engineer's time — when calculating total cost of ownership.

The compliance certification path

Data residency compliance is necessary but not sufficient. BFSI clients typically also require SOC 2 Type II certification, and increasingly a vendor assessment questionnaire that asks about incident response procedures, access controls, and employee background checks. Zonarity's enterprise deployment includes a pre-filled vendor security questionnaire and architecture diagrams designed for these assessments.