Your region, your controls, your contract.

Everything above, plus the residency controls, contract and support posture procurement needs before it signs.

SSO, scoped roles and an audit log that records configuration changes, not just requests.
Data-residency controls: declare a region per workspace and every compliance report is stamped with it, filed under it, and refused to a cross-region read. Stricter isolation is a conversation with sales, not a checkbox.
SLA commitments and dedicated support, with framework packs already wired to runtime controls.

Where your data may sit.

Some traffic cannot leave a region, and no amount of certification changes that. Declare a region per workspace and every compliance report is stamped with it, filed under it, and withheld from a cross-region read. Upstream providers still process requests in their own regions — the report discloses that data flow rather than claiming we geo-pin inference. If your requirements go further than that, it is a conversation with sales rather than a plan feature.

What procurement asks for.

SSO and scoped roles. An audit log covering configuration, not just requests. Framework packs already wired to runtime controls. SLA commitments and a named contact rather than a support queue.