Declare your region. Have it on every report.

A workspace declares its data-residency region. Every compliance report is stamped with it, filed under it, and refused to a cross-region read.

Declare a region per workspace; every compliance report is stamped with it and filed under a region-partitioned path. Physically regionalized storage is a deployment choice, not something the gateway does for you.
A cross-region read is denied rather than served — an artifact is never handed over under a residency it cannot satisfy.
Retention is the part enforced per request: payloads sit apart from the request log, and a zero-retention route only picks a ZDR-eligible channel.

A region you declare, and can prove.

Set the workspace region and every compliance report is stamped with it, rendered into region-partitioned storage, and withheld from a cross-region read rather than served under a residency it cannot satisfy. What this is not: a claim that we geo-pin inference. Upstream providers process requests in their own regions, and the report says so in as many words.

Retention is the enforced half.

Prompt payloads sit apart from the request log, so the audit trail — who called what, when, at what cost — outlives the content itself, which you can keep for hours or not at all. And a zero-retention route will only select a channel flagged ZDR-eligible: the check fails closed, so an unflagged channel is never quietly used instead.