Geographic redundancy means placing a recovery site far enough from the primary that one event cannot take both, yet close enough that latency still allows the replication you need. As a rough guide, building events need a few miles, metropolitan events tens of miles, and regional events hundreds, provided the sites share no power, network, or flood exposure.
There is no correct number. There is a correct method for arriving at one, and it starts with what you are actually defending against.
How Much Separation Does Each Threat Require?
It depends entirely on the size of the event you are planning for. Separation guidance stated as a flat distance is guidance without a threat model.
Building-scale events — fire, structural failure, a burst pipe, a localized power fault. A few miles of separation defeats these entirely.
Metropolitan events — regional grid failure, urban flooding, a major water main break, civil disruption. Tens of miles. The key variable is not raw distance but whether the two sites share infrastructure.
Regional events — hurricanes, earthquakes, wildfire, ice storms, extended grid instability across a service territory. Hundreds of miles, and the direction matters as much as the distance. Two sites separated along the same hurricane track are less independent than two sites half the distance apart on perpendicular axes.
Work out which of these your organization is genuinely planning against. Many are contractually or regulatorily bound to a specific tier, and many others have never made the decision explicitly.
Can Two Distant Sites Still Fail Together?
Yes. Two sites can be a hundred miles apart and still fail together.
Power — check whether both sites draw from the same utility, the same transmission corridor, and the same regional interconnection. Different substations on the same grid segment share a fate.
Network — carrier diversity on paper frequently is not diversity in the ground. Providers lease capacity from each other, and two "diverse" circuits regularly share a conduit, a bridge crossing, or a single building entrance. Ask for physical route documentation rather than a diversity assertion.
Flood plain and seismic zone — check both sites against the FEMA flood maps; sites in the same watershed or on the same fault system are correlated regardless of the miles between them.
Staff — if the same people operate both sites, an event that prevents them from reaching one may prevent them from working at all. Recovery staffing is part of geographic planning.
Vendors and supply chain — the same regional service provider, parts depot, or logistics operation serving both sites is another shared failure point that distance alone does not resolve.
Map these deliberately. A site pair that clears every one of them at forty miles is more resilient than a pair that shares a transmission corridor at two hundred.
How Does Distance Affect Latency and Replication?
Latency is the constraint that distance imposes, and it is governed by physics. Light in fiber travels at roughly two-thirds the speed of light in vacuum, which works out to about one millisecond of round-trip latency per hundred kilometers of fiber path — and the fiber path is always longer than the straight-line distance, often by half again.
This determines your replication options.
Synchronous replication commits a write at both sites before acknowledging it. Data loss on failure is zero. Every write pays the round-trip, so application performance degrades directly with distance. In practice this is workable at metropolitan distances and unworkable at regional ones for write-heavy systems.
Asynchronous replication acknowledges locally and ships changes continuously. Distance stops constraining performance, and you accept a recovery point measured in seconds to minutes depending on the link and the change rate.
The distance decision and the recovery point objective decision are the same decision. An organization that has committed to zero data loss has also committed to metropolitan separation, whether or not anyone framed it that way.
When Do You Need a Third Site?
Where requirements genuinely conflict — zero data loss and regional-scale protection — the resolution is usually three sites rather than a compromise on two.
A near site at synchronous distance holds a zero-loss copy and handles equipment and building failures. A far site at regional distance receives asynchronous replication and covers the regional event with a small, defined data loss window. The primary feeds both.
This costs more and it is more complex to operate and test. It is also the only configuration that satisfies both requirements honestly, and it is worth pricing before accepting a compromise that leaves one of them unmet.
Bandwidth and the Logistics of Distance
Replication bandwidth is sized by change rate, not by data volume. Estimate the peak, not the average — batch processing, month-end closes, and nightly copy jobs produce bursts that a link sized to the average will not absorb, and a replication link that falls behind during peak has a recovery point that quietly degrades exactly when it is most likely to be tested.
Distance also has a physical dimension that planning tends to omit. Every mile between sites is a mile that equipment, replacement parts, and people have to travel during an incident. A recovery site four hundred miles away is a recovery site where a hardware failure means a next-day part and a staff member on a plane.
Decide deliberately whether the far site is staffed, contracted for on-site support, or dependent on someone traveling. That answer belongs in the recovery time calculation, and it is frequently the largest number in it.