Abstract: The disclosure is directed to a failover mechanism for failing over an application service, e.g., a messaging service, from servers in a first region to servers in a second region. Data is stored as shards in which each shard contains data associated with a subset of the users. Data access requests are served by a primary region of the shard. A global shard manager manages failing over the application service from a current primary region of a shard to a secondary region of the shard. The current primary determines whether a criterion for failing over, e.g., a replication lag between the primary and the secondary regions is within a threshold, and if it is within the threshold, the failover process waits until the lag is zero. After the replication lag is zero, the application service is failed over to the second region, which then becomes the primary for the shard.