This poses a fundamental problem for many SaaS providers. How can you guarantee client data aren't sent across the pond when all the app state is held server-side?

The answer is obvious with native apps, where it's standard practice to provide server endpoint details, so client-verified data locality is simple.

I don't really know how this is practically possible in SaaS web apps.