WHITE PAPER The ServiceNow Singapore Regulated Market (RM) Cloud Data security overview and frequently asked questions Release: Yokohama WHITE PAPER 2Singapore RM Cloud v2.9 | April 2025 Release: Yokohama Introduction Government, public sector, finance, and healthcare organizations are subject to stringent data security regulations, which often require strict controls over data residency, support provision, and other criteria. To meet these customer needs ServiceNow partnered with Microsoft to create the ServiceNow Singapore RM (Regulated Market) Cloud which provides in-country data storage. This document is designed to be read alongside Securing the Now Platform which gives a holistic overview of the physical, administrative, and technical controls ServiceNow has in place to protect customer data. In addition, ServiceNow provides the CORE Compliance Portal where customers (and prospects under NDA) can access prefilled vendor risk questionnaires, certifications and attestations, internal standard operating procedures, and results of penetration tests and audits. Find out how to access the ServiceNow CORE Compliance Portal here. Video: ServiceNow CORE Compliance Portal Note: Some details provided in this document are specific to Singapore RM Cloud offering and supersede information found elsewhere about the standard ServiceNow Commercial Cloud. WHITE PAPER Table of contents Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Architecture for data residency . . . . . . . . . . . . . . . . . . . . .4 Data residency and high availability . . . . . . . . . . . . . . . . 5 Customer access. . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 ServiceNow access . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Data encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Certifications and attestations . . . . . . . . . . . . . . . . . . . 5 ServiceNow cloud comparison . . . . . . . . . . . . . . . . . . . 6 Frequently asked questions . . . . . . . . . . . . . . . . . . . . . . . 7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9 Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9 WHITE PAPER 4Singapore RM Cloud v2.9 | April 2025 Release: Yokohama Customers can choose the ServiceNow Singapore RM Cloud data storage offering to meet their data residency requirements while retaining the high levels of scalability and resilience that they have come to expect from the Now Platform. Architecture for data residency Customers can choose the ServiceNow Singapore RM Cloud data storage offering to meet their data residency requirements while retaining the high levels of scalability and resilience that they have come to expect from the Now Platform. Any customer in Singapore who requires in-country data residency can purchase the ServiceNow Singapore RM Cloud service. By using a combination of ServiceNow and Azure infrastructure customer instances (and most services) are hosted in local Azure data centers, and data is stored in-country. This includes data for common services such as email and encryption key management. With this architecture, the ServiceNow software platform is deployed in the form of virtual machines which (together with the software running within them) are owned and operated by ServiceNow. The hypervisor and supporting infrastructure layers below are owned and operated by Microsoft Azure. These hypervisors and virtual machines are not shared with any other Azure customer, further enhancing the security of customer data. • The in-region boundary includes ServiceNow colocation facilities, shared services, and the Azure infrastructure • The in-country boundary contains the Azure data centers, Now Platform customer instances, and services associated with customer data The illustration below shows the distribution of services. In-Country Boundary In-Region Boundary ServiceNow Commercial Cloud Azure VPC Peering AHA Replication Enforced TLS via HTTPS Private Connectivity (dedicated leased lines) Internet Customer Azure In-Country Data Center 1 Azure In-Country Data Center 2 Email Encryption Keys Customer Instances Now Log Analytics Machine Learning EncryptedStorage Email Encryption Keys Customer Instances Now Log Analytics Machine Learning EncryptedStorage Local shared services Load balancer Local shared servicesLoad balancer Regional Colocation Facility 1 (Now Platform) Regional Colocation Facility 2 (Now Platform) Global shared services Regional shared services WHITE PAPER 5Singapore RM Cloud v2.9 | April 2025 Release: Yokohama Data residency and high availability Customer instances are hosted in redundant Azure data center pairs within the boundaries of Singapore. All variations of the ServiceNow Cloud benefit from the ServiceNow Advanced High Availability Architecture. Customers subject to Multi-Tier Cloud Security (MTCS) Level 3 in Singapore and who require in-country data residency can use the ServiceNow Singapore RM Cloud service to adhere to these requirements. Customer access All customer access to the service is routed exclusively via the ServiceNow colocation facilities, using HTTPS. Data is transferred internally between ServiceNow and Azure data centers across private leased lines (Azure ExpressRoute), with no direct Internet access from the Azure infrastructure. Customers can also choose a direct connection to the ServiceNow colocation facilities at an additional cost. ServiceNow access Authorized ServiceNow support and operations personnel can only access the Azure data centers via the ServiceNow colocation facility infrastructure utilizing Azure ExpressRoute connections (they cannot connect directly across the Internet). Access to ServiceNow infrastructure within the Azure cloud is only possible from a secure Virtual Desktop Environment (VDE) using direct private connections to the ServiceNow colocation facility. Rigorous authentication, including client certificates and two-factor authentication, is required to access the VDE. All ServiceNow software, services, and data are handled only by ServiceNow personnel. No access is possible by Azure administrators. Data encryption Most data encryption options remain the same as with the standard ServiceNow Commercial Cloud, including the comprehensive data in transit and data at rest mechanisms. See the ServiceNow Encryption documentation for more information. The Azure infrastructure brings the additional benefit of storage with SSE-CMK (Server Side Encryption, Customer Managed Key). This utilizes 256-bit AES encryption for the Key Encryption Key (known as Envelope Encryption). ServiceNow protects and manages the keys in a dedicated Azure Key Vault residing in-country. Certifications and attestations The existing ServiceNow certifications and attestations also apply to the ServiceNow Singapore RM Cloud service. Further information about these can be found on the Compliance section on the ServiceNow Trust site. WHITE PAPER 6Singapore RM Cloud v2.9 | April 2025 Release: Yokohama ServiceNow cloud comparison The existing ServiceNow security and privacy practices, procedures, certifications, and attestations are applicable to the ServiceNow Singapore RM Cloud offering, and are described in detail in the white papers Securing the Now Platform and Advanced High Availability Architecture. However, there are some notable differences. This table illustrates the key differences between the regional ServiceNow Commercial Cloud and the ServiceNow Singapore RM Cloud offerings. Element Regional ServiceNow Commercial Cloud ServiceNow Singapore RM Cloud • Physical colocation facilities • Co-location spaces leased to and managed by ServiceNow • Microsoft owned and managed • Cloud infrastructure • Deployed, managed, and operated by ServiceNow • Deployed, managed, and operated by ServiceNow • Physical network and compute infrastructure owned by Microsoft • Operating jurisdictions • Regional, across different geographies • Country-specific (Singapore) • Availability • Instance transfers and failovers occur between the paired regional colocation facilities • Instance transfers and failovers occur between the paired in-country Azure data centers • Customer instance isolation • Multi-instance architecture on ServiceNow managed physical infrastructure • Private network infrastructure • Multi-instance architecture on ServiceNow managed virtual infrastructure • Dedicated ServiceNow virtual machines, not shared with other Azure customers • No hypervisors shared with other Azure customers • Private virtual network infrastructure, not shared with other Azure customers • Encryption in transit • TLS is enforced for all public network traffic to ServiceNow • All Azure bound traffic routed first via ServiceNow colocation facilities • No direct Azure access from public Internet for customers or ServiceNow • TLS is enforced for all public network traffic to ServiceNow • Full disk encryption • Optional, additional cost full-disk encryption • Key management undertaken by ServiceNow • Azure Storage encryption • Key management undertaken by ServiceNow • Certifications and attestations • ISO 27001, 27017, 27018, and 27701 • SSAE18 SOC 1 and SOC 2 • MTCS Level 3 (Singapore) • The Azure cloud complies with over 90 different certifications globally • MTCS Level 3 (Singapore) The following services and related processes are provided in an identical manner in both cloud offerings: • Advanced High Availability • Vulnerability management • Malware protection • Denial-of-Service (DoS/DDoS) protection • System patching and maintenance • Operations • Customer support • Security incident response WHITE PAPER 7Singapore RM Cloud v2.9 | April 2025 Release: Yokohama Frequently asked questions What is the purpose of the ServiceNow Singapore RM Cloud? To enable customers in Singapore with data residency requirements to use ServiceNow with the assurance that their data will be stored in-country. Can anyone use the ServiceNow Singapore RM Cloud service? Any customer in Singapore who requires in-country data residency can purchase the ServiceNow RM Cloud service.