Glossary
Multi-region storage
Multi-region storage keeps data in two or more locations far enough apart that a single power cut, flood or network failure cannot take all of them out. Distance protects against shared failures, and the same distance forces a choice between zero data loss and write speed.
How far apart is far enough?
Sites need separate power, separate network paths and separate weather. Two buildings on the same grid substation share a failure, however many copies they hold. The farther apart the sites, the fewer events reach both. Distance also costs time, because light in fiber travels about 200 km in a millisecond. That works out to roughly 1 ms of round trip per 100 km, before any equipment delay, and real cable routes are longer than the straight line between sites.
Which designs exist, and what does each give up?
| Design | How a write is handled | What it trades |
|---|---|---|
| Asynchronous replication | Acknowledged locally, shipped to the other site later | Fast writes; the most recent writes can be lost |
| Synchronous or stretched cluster | Acknowledged only after both sites confirm | No loss; each write pays the round trip, so it stays within a metro area |
| Geo-distributed erasure coding | Object split into fragments spread across three or more sites | No site holds a full copy; more traffic between regions |
At 1,000 km the round trip is at least 10 ms, which is added to every synchronous write. That is why synchronous designs stay within about a metro distance, and anything farther accepts lag. The lag is the recovery point objective, so the link has to be sized for the busiest hours, not the average. The fragment approach builds on erasure coding, and the copy-based approach on data replication and cloud storage replication.
Why do failovers fail when the copies are fine?
The data surviving is only half of the question. A region can go dark while every replica is healthy and the applications keep pointing at the dead endpoint. Three basics cause most failed cutovers: an undersized replication link that left the replica hours behind, older data that was never copied because replication started after it was written, and applications with hardcoded endpoints. The list below turns them into a test.
- Measure the replica's age against the target recovery point during a busy period.
- Compare object counts and checksums for the oldest data, not only recent writes.
- Search applications for fixed addresses and confirm they follow a name that can be redirected.
- Run the cutover itself, with real clients, and time it.
What else does a second region provide?
Beyond disaster recovery, a second region gives users near it local reads, and residency rules can keep chosen data inside one region by policy. Designs that serve users from both sites at once are covered under active-active disaster recovery, and keeping sites close to the data that uses them is the subject of data locality.
Frequently asked questions
Is multi-region storage the same as multi-site storage?
The ideas overlap. Region implies sites separated enough to avoid shared failures such as a regional outage, while multi-site can describe sites within one metro area.
Can multi-region storage have zero data loss?
Only with synchronous writes, which limits distance. Beyond a metro area, designs accept an asynchronous lag or use erasure coding across sites.
How often is a failover tested?
Practice varies, but a failover that has never been run end to end is an assumption. Regular tests find link, data and endpoint problems before an outage does.
Related terms
- Data replication: copies kept at other sites.
- Recovery point objective: the loss window distance creates.
- Erasure coding: fragments spread across regions.
- Disaster recovery: the plan a second region serves.
- Active-active disaster recovery: serving users from both sites.
- Cloud storage replication: replicating across regions or providers.