Cloud, hybrid or bridge: where should your analytics data live?

Every analytics project eventually hits the same meeting. Security wants to know where the data will be stored. Finance wants to know what it will cost. The data team wants dashboards that load in under two seconds. And legal has a contract clause that nobody has read in three years. The usual outcome is a blanket rule — "everything goes to the warehouse" or "nothing leaves our network" — that is wrong for half of the sources it covers.

As a solutions architect at Kimo, I spend most of my week in that meeting. This post is the framework I use to get out of it with a decision everyone can sign. It applies to any stack, but I will use Kimo’s two modes — Bridge (live query pushdown through Kimo Bridge) and Cloud (sync into Kimo’s managed cloud) — as the concrete options.

What are the three options, exactly?

The five questions that decide where a source should live

Run every source through these questions in order. The first two can veto an option outright; the last three are trade-offs.

1. 1Sensitivity and obligations. Does the source contain personal data, regulated data, or data a customer contract restricts? If yes, the burden is on anyone proposing a copy to justify it.
2. 2Residency and transfers. Would a copy move data into another jurisdiction or to another processor? That triggers legal work before any engineering work.
3. 3Freshness. How old can an answer be before it is wrong? Minutes, hours or a day?
4. 4Volume and query shape. Do typical questions return small aggregates, or do analysts scan months of raw events interactively?
5. 5Load and cost. Can the source absorb analytical queries, and what does each option cost in compute and data transfer?

1. Sensitivity: every copy is a new obligation

Under the GDPR, personal data must be "limited to what is necessary" for the purpose and kept in identifiable form no longer than necessary.¹Source 1 · gdpr-info.eu (Regulation (EU) 2016/679), 2016Art. 5 GDPR: Principles relating to processing of personal datagdpr-info.eu A synced analytics copy is not forbidden by that principle, but it is a second system you have to justify, secure, include in retention schedules and purge on erasure requests. Live pushdown sidesteps much of that because aggregates — revenue by month, signups by channel — leave the database, while the rows behind them do not.

2. Residency: transfers and processors need paperwork

If a copy of personal data lands outside the European Economic Area, Chapter V of the GDPR applies: a transfer is only lawful if the conditions of that chapter are met by both controller and processor.²Source 2 · gdpr-info.eu (Regulation (EU) 2016/679), 2016Art. 44 GDPR: General principle for transfersgdpr-info.eu The European Data Protection Board’s recommendations on supplementary measures describe how exporters should assess the destination and add safeguards where needed.³Source 3 · European Data Protection Board, 2021Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal dataedpb.europa.eu And any vendor that stores the copy is a processor you must vet for "sufficient guarantees".⁴Source 4 · gdpr-info.eu (Regulation (EU) 2016/679), 2016Art. 28 GDPR: Processorgdpr-info.eu None of this makes cloud sync impossible — Kimo’s cloud lets you pick a region — but it is the reason residency-sensitive sources often start in Bridge mode.

3. Freshness: live is free, fresh copies are not

With pushdown, every dashboard view reads the current state of the database. With sync, freshness equals the sync interval plus the time to process it. Going from daily to every 15 minutes is usually possible, but it multiplies sync jobs and source load. If a team cares about "right now" — open incidents, today’s signups, an investor asking about this month’s MRR mid-call — live wins.

4. Volume and query shape: where does the scan happen?

Pushdown is efficient when the database does the heavy lifting and returns a small result. It is inefficient when analysts repeatedly scan large histories on a transactional database that was not built for it. If your typical question is "weekly active accounts for the last two years, sliced six ways", a columnar copy in the cloud will be faster and will not slow your application down.

5. Load and cost: compute and egress

Live queries consume CPU on your side. Run them on a read replica — PostgreSQL standby servers accept read-only queries⁵Source 5 · PostgreSQL DocumentationHot Standbypostgresql.org — and the primary is unaffected. On the cost side, remember data transfer pricing is asymmetric on major clouds: AWS, for example, charges nothing for inbound transfer but bills outbound transfer to the internet per service and region.⁶Source 6 · AWS Architecture Blog, 2021Overview of Data Transfer Costs for Common Architecturesaws.amazon.com A full sync of a large table out of your cloud account repeatedly pays that egress; a pushdown query returning a few hundred rows barely registers.

A decision matrix you can use today

Worked example: a 60-person B2B SaaS company

Consider an illustrative company — call it Northwind Cloud — with an EU-hosted Postgres production database, a ClickHouse event store, Stripe billing, HubSpot, Google Ads and Search Console. Here is how the framework sorts it:

The result is hybrid: the semantic layer joins live account data from the bridge with synced billing and marketing data, so the board deck and the marketing command center both read from one set of definitions, wherever the rows physically sit.

Common mistakes when choosing

• Deciding once for the whole company. A blanket rule optimizes for the most sensitive source and punishes the rest, or the reverse.
• Pointing live queries at the primary. Use a replica or a dedicated analytics role with statement timeouts.
• Forgetting caches. A result cache is a copy too. In Kimo it is per source, has a TTL and can be set to zero; document what you chose.
• Ignoring history. Bridge mode shows the database as it is now. If you need "what did this look like last quarter" and the source overwrites rows, you need snapshots — either in your own warehouse or in Cloud mode.
• Treating network access as trust. An IP allowlist into your database is a standing path. Outbound-only, mutually authenticated connections with per-request authorization follow the zero-trust model instead.⁷Source 7 · NIST, 2020SP 800-207: Zero Trust Architecturecsrc.nist.gov

Write it down: the one-page source register

This register is what security reviewers and auditors actually want to see, and it makes the next change cheap: when a contract adds a residency clause, you flip one source from Cloud to Bridge instead of re-architecting. In Kimo, the Bridge page shows each source’s mode, and the connectors page shows sync schedules, so the register stays honest.

For the deeper architecture — tunnel design, caching, identity passthrough and how this compares to warehouse-first stacks — read our whitepaper Your Data, Your Rules. If you are ready to try it, start with Install Kimo Bridge with Docker.