Your region, your controls, your contract.

Everything above, plus the residency controls, contract and support posture procurement needs before it signs.

SSO, scoped roles and an audit log that records configuration changes, not just requests.
Data-residency controls that declare a workspace region and partition the evidence to it. Stricter isolation is a conversation with sales, not a checkbox.
SLA commitments and dedicated support, with framework packs already wired to runtime controls.

Where your data may sit.

Some traffic cannot leave a region, and no amount of certification changes that. Declare a region per workspace and the evidence is stamped with it, partitioned to it, and withheld from a cross-region read. What it does not claim is geo-pinned inference — upstream providers process requests in their own regions, and the report says so. If your requirements go further, that is a conversation with sales rather than a plan feature.

What procurement asks for.

SSO and scoped roles. An audit log covering configuration, not just requests. Framework packs already wired to runtime controls. SLA commitments and a named contact rather than a support queue.