Storing Vietnamese User Data Locally Without Moving Your Whole Stack

Decree 53 and similar data-localization requirements in Vietnam are forcing foreign companies to keep user data inside the country. The reaction inside many engineering teams sounds the same: "Do we have to move everything?" The answer is almost always no. You only need to store the Vietnamese user data inside Vietnam, everything else, your application servers, databases for other regions, CI/CD pipelines, can stay exactly where they are. This post explains how to separate Vietnamese user data from the rest of your stack, route new sign-ups to the right backend, and run the whole thing on a monthly billing VPS inside a Vietnamese data center, using only the local infrastructure you need.

Why "Store User Data in Vietnam" Does Not Mean Move Your Whole Stack

Even the most ambiguous version of Decree 53 (the 2022 Cybersecurity Law implementation, known formally as Nghị định 53/2022/NĐ-CP) asks only that certain categories of user data generated by Vietnamese users, names, phone numbers, service history, and communications metadata, be stored inside Vietnam. There is no requirement that the business logic layer, analytics, an international CDN, or your Git repository leaves wherever it currently lives. The law cares about the storage location of specific data fields; it does not prescribe architecture.

Many teams still believe they must replicate an entire cloud region inside Vietnam. That is a misunderstanding. You need a small footprint: a database or object store, a thin API shim to write and read that data, and a VPS that sits on the domestic network. The rest of your stack stays as-is. The cost of compliance, in this scenario, becomes the cost of a single Linux VPS with a Vietnam IPv4 and a minimal data plane.

越南数据合规只需在境内存储用户数据，无需迁移整个应用架构。

Vietnamese data compliance only requires storing user data inside the country, not migrating your entire application architecture.

Key Takeaways

• Decree 53 targets the storage location of Vietnamese user data, your application servers, analytics, and international services can remain outside Vietnam.
• A single Vietnam VPS with an NVMe drive, full root access, and a dedicated IPv4 is enough to act as the data residency layer for millions of users.
• Domestic bandwidth in Vietnam is 100 Mbps on a 1 Gbps port, enough for data writes from an API shim. International bandwidth is a shared pool (~4-10 Mbps) because the local network is optimised for domestic traffic.
• Routing new Vietnamese users to the Vietnam backend is trivial with a geolocation-based decision inside your API gateway or CDN.

Who Needs This and When

If you are a SaaS company, a mobile app developer, or a platform that accepts Vietnamese users and stores any of their personal data (names, phone numbers, email addresses, government IDs, chat history, financial records), you likely fall under the scope of Decree 53. Enforcement has been gradual, but the legal obligation exists. The pragmatic approach is to prepare the infrastructure now rather than scramble under a request from Vietnam's cybersecurity authority (known as A05, a unit under the Ministry of Public Security).

The threshold that triggers the requirement is not fully public, but companies that serve a significant number of Vietnamese users or process sensitive personal data should treat it as active. Foreign companies that have already received written inquiries from A05 confirm that the response window is short, you need the storage layer ready before the request arrives.

Step 1, Separate the User Data Plane from the Application Plane

The cleanest design for data localization without full migration is a split backend:

• Global backend: your existing application servers, databases for non-Vietnamese users, CI/CD, monitoring. No changes required.
• Vietnam data plane: a dedicated PostgreSQL, MySQL, or MinIO/S3 instance running on a VPS inside a Vietnamese data center. This instance stores only data fields that belong to Vietnamese users. The global backend never writes these fields directly, it calls a thin API on the data plane.

You define a clear boundary: every user record is tagged with a country_code field. On sign-up or during data collection, your application checks the user's geolocation (via IP or account registration data). If the country code is VN, the sensitive fields are written to the Vietnam data plane instead of the global database.

This split can be as simple or as complex as you need. The minimum viable setup is a single API endpoint on the Vietnam VPS that accepts writes for a predefined list of fields and echoes reads. The global application calls this endpoint securely over HTTPS.

Example: Writing a Vietnamese user's phone number to the Vietnam data plane

# On the global application server (pseudo-code)
if user.country_code == "VN":
    # Send only the sensitive fields to the Vietnam data plane
    response = http.post(
        "https://vn-data-plane.yourcompany.com/api/store",
        json={
            "user_id": user.id,
            "phone": user.phone,
            "full_name": user.full_name,
            "service_history": user.recent_activity
        },
        headers={"Authorization": "Bearer vn-api-key"}
    )
    # Continue storing non-sensitive data (session tokens, anonymised analytics)
    # in the global database as usual.

Your global database never touches the Vietnamese user's phone or full name. If the Vietnam data plane goes offline, the global application can queue the data and retry; it never loses the user experience.

Step 2, Choose a Vietnam VPS as the Data Residency Layer

The Vietnam data plane needs a physical location inside Vietnam. The three main data center operators are Viettel IDC (military-owned, largest by coverage), VNPT IDC (state-owned telecom), and FPT Telecom (private). All three are Tier 3 facilities. Your VPS provider will have its infrastructure in one or more of these. The important factor is not which operator but that the server is physically inside Vietnam and connected to the domestic network.

For the data plane purposes, even a modest VPS is sufficient:

• NVMe SSD for low-latency writes and reads.
• Dedicated IPv4 from the Vietnam IP range, so reverse DNS can show a Vietnamese origin and geo-routing works correctly.
• Full root access (Linux) or Administrator (Windows Server) so you can install PostgreSQL, Redis, or an object store without restrictions.
• 99.9% uptime with snapshots and backups for data safety.

A VNLite-tier VPS with 1 vCPU, 2GB RAM, and a 20GB NVMe drive can serve the API shim and a small PostgreSQL instance for hundreds of thousands of users if the data plane only stores structured fields and no file uploads. Uploads require more storage, but the pattern is the same.

Network facts to be clear about: domestic bandwidth inside Vietnam is 100 Mbps on a 1 Gbps port. This is the speed between your VPS and users or services inside Vietnam. International bandwidth (traffic leaving Vietnam to the global internet) is a shared pool of roughly 4 to 10 Mbps. That figure is important: the data plane is meant to serve data to the domestic network, not to be a high-speed international transit node. Your global application calling the data plane from outside Vietnam will see the shared international throughput. Keep the write payloads small and batch them where possible.

Step 3, Route Vietnamese Users to the Data Plane via Geolocation

Once the data plane is ready, your application must decide, at the point of data collection, which backend to write to. The easiest approach is a geolocation check in your API gateway or CDN edge. Here is a route with Fastly or Cloudflare Workers:

// Pseudocode, geolocation-based routing
addEventListener("fetch", event => {
    const country = event.request.cf.country; // Cloudflare country code
    if (country === "VN" && isSensitiveEndpoint(event.request.url)) {
        return event.respondWith(rewriteToVNDataPlane(event.request));
    }
    return event.respondWith(routeToGlobalBackend(event.request));
});

If you do not use a CDN that exposes country codes, you can run the geolocation check inside your application server using a GeoIP database like MaxMind. The flow is the same: detect Vietnam → write to the local data plane port 443 → global backend skips those fields.

For reads, your API shim on the Vietnam VPS should expose an authenticated endpoint that the global backend calls when displaying a Vietnamese user's profile. Because the read crosses international bandwidth, keep responses small, IDs and short text fields. Large file uploads (profile pictures, documents) should be stored separately and indicated by a URL, not the binary content.

Step 4, Verify the Data Stays Inside Vietnam

Once the data plane is running, verify that writes hit the Vietnam VPS and never leave the domestic network. Use traceroute and curl from a user inside Vietnam (ask a local colleague or run a lightweight check from a second Vietnam VPS):

# From a machine inside Vietnam, call the data plane's API endpoint
curl -I https://vn-data-plane.yourcompany.com/api/health

# Expected: the response comes from an IP in the Vietnam range.
# Check the IP with a whois lookup to confirm the country code.
whois [IP of your VPS] | grep -i country

Also confirm that your global database logs show no writes to protected fields for Vietnamese users. Query your global application's write log or database audit trail:

# Example, PostgreSQL audit trail on the global database
SELECT COUNT(*) FROM user_actions
WHERE action = 'write_sensitive_data'
AND country_code = 'VN'
AND timestamp > now() - interval '24 hours';
-- Should return 0 if routing works correctly.

If you see writes to sensitive Vietnamese user fields in the global database, the routing is leaking data. Fix the geolocation check or the application flow before it is detected in a compliance review.

Troubleshooting Common Issues

Writes timeout because of international bandwidth

Your global application calling the Vietnam data plane experiences latency because international bandwidth out of Vietnam is a shared pool (~4-10 Mbps). Keep write payloads small (a few KB). For any payload over 1 MB, split the write or upload to an S3-compatible bucket inside Vietnam first, then store the URL. If timeouts persist, configure a connection pool with retries and exponential backoff.

GeoIP routing misidentifies users

Vietnamese users connecting through international VPNs or roaming abroad may show a non-Vietnamese IP. The safe approach: allow the user to self-declare their residency during registration. If the user claims to reside in Vietnam, store their data in Vietnam regardless of IP. This is more conservative than the law requires, but it avoids a classification error.

The VPS runs out of storage as user data grows

Start with a 20 GB NVMe drive on a VNLite plan and add a separate volume or upgrade to a larger plan (4 GB RAM / 50 GB NVMe or 8 GB RAM / 100 GB NVMe) once usage approaches 80%. Enable snapshots before any upgrade. If you need file storage (uploads, images), add a MinIO instance on the same VPS pointing to an additional attached volume, do not store binaries in the database.

中文摘要

本文解释了外国公司如何在不需要迁移整个技术栈的前提下，在越南境内存储越南用户数据。最实用的方法是只用一个越南VPS（NVMe存储、专用IPv4、完全root权限）作为数据平面，通过API shim接收敏感字段的写入，而主应用服务器和数据仍留在国外。越南到国际的带宽约为4-10Mbps，因此写入负载要小。建议在API网关层基于用户地理位置进行路由，分离越南用户数据的写入路径，并定期验证数据是否真正留在越南境内。本文为一般性信息，具体合规问题请咨询越南律师。

FAQ

Related articles

• How to rent a VPS in Vietnam as a foreign company
• Do you need a Vietnamese entity to buy hosting in Vietnam?
• Paying for Vietnamese hosting with PayPal, what to expect
• Does Decree 53 require my company to host data in Vietnam?