Abstract: Implementations are directed to providing a data custodian region within a public cloud, the data custodian region being specific to a customer of an enterprise having services hosted on the public cloud, the public cloud including regional data centers, through which customer data passes and/or is stored, each data center being at a location within a region, storing at least one union definition that is used to control access, transfer, and storage of customer data within respective regional data centers, the at least one union definition being provided by a data custodian associated with the customer, monitoring a plurality of actions of respective workflows executed using the one or more computer-implemented services hosted on the public cloud, for each action, logging a data event within a repository of the data custodian region, and determining whether the data event complies with the at least one union definition.

Abstract: Implementations are directed to providing a data custodian region within a public cloud, the data custodian region being specific to a customer of an enterprise having services hosted on the public cloud, the public cloud including regional data centers, through which customer data passes and/or is stored, each data center being at a location within a region, storing at least one union definition that is used to control access, transfer, and storage of customer data within respective regional data centers, the at least one union definition being provided by a data custodian associated with the customer, monitoring a plurality of actions of respective workflows executed using the one or more computer-implemented services hosted on the public cloud, for each action, logging a data event within a repository of the data custodian region, and determining whether the data event complies with the at least one union definition.

Abstract: Methods, systems, and computer-readable storage media for providing a data custodian portal that communicates with a data custodian region within an infrastructure of a public cloud through a connector executed within the data custodian region, the data custodian region being specific to a customer of an enterprise having one or more computer-implemented services hosted on the public cloud, the infrastructure including a plurality of regional data centers, through which customer data passes and/or is stored, each data center being at a location within a region, in response to a determination that a data event associated with at least union fails to comply with a union definition of the at least one union, displaying a notification within a graphical user interface (GUI) of the data custodian portal, the union definition being used to control one or more of access, transfer, and storage of customer data within respective regional data centers, the union definition being provided by a data custodian associated