If your compliance team built its playbook around AWS us-west-2, they've never had to answer "which state is our PHI physically sitting in right now?" because the honest answer is usually "we don't know, and neither does AWS." IDACORE Boise answers that question in one word: Idaho. Data stays here, doesn't cross state lines, and you can point auditors to a street address.
Why Does "Which State" Matter for Compliance?
Cloud regions are marketing names, not legal addresses. "us-west-2" spans multiple facilities across Oregon, and hyperscalers reserve the right to replicate data across availability zones for redundancy — availability zones that may or may not share a state line, depending on the week and the service tier you're paying for. Your compliance team in Seattle has spent years writing policies that say "data remains in the US" because that's the most specific commitment the vendor would give them.
That's fine for a lot of workloads. It's not fine for a growing list of state and sector requirements that are getting specific about physical location — not just country, not just "region," but jurisdiction. Healthcare contracts with state Medicaid programs. Financial services firms working with state-chartered credit unions. Government contractors with Idaho or Oregon state agency work. These contracts increasingly ask: can you certify exactly where this data lives, and can you prove it didn't move?
IDACORE Boise gives you an answer you can defend in an audit: the server is at 2653 S Victory View Way, Boise, Idaho. It doesn't replicate to a shadow copy in another state unless you build that yourself. Your data residency commitment is a physical fact, not a service-tier promise.
What Compliance Posture Does Boise Actually Have?
This isn't a bare-metal rack farm hoping you don't ask questions. IDACORE Boise carries SOC 2 Type II, PCI DSS, NIST 800-53, SSAE-16, and HITRUST CSF certifications, and the facility is built to be compliance-ready for HIPAA, financial services, and government workloads. That's the audit paperwork your compliance team actually needs to close a vendor risk assessment — not a sales deck claiming "enterprise-grade security" with nothing behind it.
The facility itself backs this up operationally: N+1 UPS and cooling across 1.4MW of capacity and 34,000 square feet, so uptime isn't resting on a single point of failure. Seven on-net carriers — Zayo, Lumen/Level 3, Cogent, CenturyLink, Syringa, Cable One, and Hurricane Electric — mean your connectivity redundancy doesn't depend on one telco having a good day.
What Does "Data Doesn't Cross State Lines" Actually Mean in Practice?
It means the physical media holding your data — the drives, the servers — stays inside the Boise facility unless you explicitly move it. No cross-region replication job silently copying a backup to a bucket in Virginia. No "we moved your workload to a different AZ for capacity reasons" email three months after you signed the contract. If your retention policy says data stays in Idaho, that's an infrastructure fact you control, not a configuration setting a cloud provider could change on you.
A Concrete Example: Healthcare SaaS Moving Off a Hyperscaler
A healthcare SaaS company serving providers across Idaho and the Treasure Valley came to us running patient scheduling data on a major cloud platform, paying close to $40,000/month in a mix of compute, storage, and egress. Their compliance officer had been trying for a year to get a straight answer from their cloud account rep about exactly which physical facilities touched PHI during backup and failover. She never got one.
They moved their database tier and application servers into IDACORE Boise colocation. Power draw came in around 60kW across their deployment — $18,000/month at $300/kW, plus IP transit on a 10G commit at $2,000/month. Total colo and connectivity spend landed around $20,000/month, with the rest of their stack (frontend, CDN) staying where it made sense. Their new monthly infrastructure cost dropped to roughly $26,000 — a 35% reduction — and more importantly, their compliance officer can now write "all PHI storage and processing occurs at a single named facility in Boise, Idaho" and mean it.
| Factor | Hyperscaler (typical) | IDACORE Boise |
|---|---|---|
| Physical location transparency | Named "region," specific facility not disclosed | Named street address |
| Cross-state replication | Possible without notice (AZ failover) | Does not happen unless you build it |
| Compliance certifications | Varies by service tier | SOC 2 Type II, PCI DSS, NIST 800-53, SSAE-16, HITRUST CSF |
| Egress cost model | Per-GB, scales with traffic | Flat 95th percentile transit, committed bandwidth |
| Contract term | Often 36 months | 12 months standard |
Does This Apply to Government and Financial Workloads Too?
Yes, and it's often a harder requirement there than in healthcare. State agency contracts in Idaho frequently specify that data processed on behalf of the state stays within state boundaries — not as a nice-to-have, but as a procurement condition. Financial services firms working with state-chartered institutions face similar language in vendor agreements, particularly around records retention and disaster recovery siting.
If your organization needs a second site for DR purposes while maintaining the same residency guarantee, IDACORE North in Coeur d'Alene gives you an Idaho-to-Idaho failover path — about 45 minutes from Spokane, still inside state lines, same $300/kW/month power pricing as Boise. You can build a two-site DR posture entirely within Idaho without ever touching a cloud region whose boundaries you can't pin down.
What About the Networking Side of Compliance?
Data residency isn't just about where the disks sit — it's about where the traffic goes. IDACORE runs its own ASN and BGP peering, a legacy of founding and operating an ISP with peering at the Seattle Internet Exchange. That matters for compliance because we control routing decisions directly; we're not reselling someone else's transit and hoping their peering policy matches your risk tolerance. IP transit is priced on committed bandwidth — a 10G commit runs $2,000/month at $0.20/Mbps, billed 95th percentile — which gives your finance team a flat, forecastable number instead of a hyperscaler egress bill that scales with your success and blows up your budget the month you go viral.
Frequently Asked Questions
Does Idaho have a specific data residency law like GDPR or CCPA?
Idaho doesn't have a comprehensive state data privacy statute as of now, but sector-specific requirements apply — HIPAA for healthcare, state procurement rules for government contracts, and contractual residency clauses many enterprises now write into vendor agreements regardless of state law. IDACORE Boise's physical, single-facility model lets you meet contractual residency commitments even where no statute mandates it.
Can I prove to an auditor that my data never left Idaho?
Yes. IDACORE Boise is a single named physical facility at 2653 S Victory View Way — there's no cross-region replication happening unless you configure it yourself. Combined with SOC 2 Type II and HITRUST CSF certifications, you have both the physical fact and the audited paper trail to show an auditor.
How is this different from choosing an AWS region in the Pacific Northwest?
AWS regions span multiple facilities and may replicate data across availability zones in different physical locations without disclosing exact addresses. IDACORE Boise is one facility, one address, and no automatic cross-site replication — you get certainty, not a regional label.
What compliance certifications does IDACORE Boise hold?
SOC 2 Type II, PCI DSS, NIST 800-53, SSAE-16, and HITRUST CSF, with the facility built to be compliance-ready for HIPAA, financial, and government workloads.
Can I combine Idaho data residency with disaster recovery across two sites?
Yes. IDACORE North in Coeur d'Alene, about 45 minutes from Spokane, uses the same $300/kW/month power pricing as Boise, letting you build a two-site DR architecture entirely within Idaho state lines.
If your compliance team needs a straight answer about where your data physically sits, IDACORE Boise gives you one — a named facility, audited certifications, and no cross-state replication surprises. Talk to us about moving your workload.
