A multi-tenant cloud system comprising: a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area; a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area; the second data center receiving a request as a Uniform Resource Locator, URL, from a first client of the first plurality of registered clients to perform a first write for a resource at the second data center, wherein the first data center is a master region for the first client and includes an identity account for the first client, and the second data center is a replica region for the first client and does not include an identity account for the first client; the second data center determining if the resource requires a local write based on an identified list of resources that support local write; the second data center, in response to determining that the resource requires a local write, generating a call to the first data center, the call comprising a second write for the resource at the first data center, the second write comprising retrieved data corresponding to the first write and a special header that is signed using a global signing key; the first data center, in response to receiving the second write and authenticating the special header by decrypting a value using the global signing key, retrieving profile attributes of the first client that are part of the first write request, and writing on the profile attributes of the first client based on the first write; the first data center, sending the retrieved profile attributes of the first client to the second data center; and the second data center, upon receiving the retrieved profile attributes from the first data center, performing the first write on the retrieved profile attributes. a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area; a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area; the second data center receiving a request as a Uniform Resource Locator, URL, from a first client of the first plurality of registered clients to perform a first write for a resource at the second data center, wherein the first data center is a master region for the first client and includes an identity account for the first client, and the second data center is a replica region for the first client and does not include an identity account for the first client; the second data center determining if the resource requires a local write based on an identified list of resources that support local write; the second data center, in response to determining that the resource requires a local write, generating a call to the first data center, the call comprising a second write for the resource at the first data center, the second write comprising retrieved data corresponding to the first write and a special header that is signed using a global signing key; the first data center, in response to receiving the second write and authenticating the special header by decrypting a value using the global signing key, retrieving profile attributes of the first client that are part of the first write request, and writing on the profile attributes of the first client based on the first write; the first data center, sending the retrieved profile attributes of the first client to the second data center; and the second data center, upon receiving the retrieved profile attributes from the first data center, performing the first write on the retrieved profile attributes.