residency is not Sovereignty
When jurisdication is foreign,
control is illusory.
The governance gap
Four approaches. None of them sovereignty.
Most organisations have answered sovereignty concerns with residency clauses, encryption, on-premises hardware, or contractual transfer mechanisms. Each addresses where data sits. None addresses who controls the keys, who enforces access policy, and whether that enforcement is continuous or point-in-time.
01
Cloud with data residency commitments
A US-headquartered provider operating a UK or European data centre remains subject to US law. Data can be compelled without the host government’s knowledge and without recourse through local courts.
02
Encryption at rest and in transit
Standard encryption stops opportunistic access, not compelled disclosure by the platform provider itself. The question is never whether data is encrypted — it is who holds the keys, and under whose legal authority they can be surrendered.
03
On-premises without sovereign governance
Legacy infrastructure inside national boundaries settles physical jurisdiction but leaves the governance layer open: policy enforcement, access control, and the ability to demonstrate control to a regulator.
04
Cross-border transfer mechanisms
Adequacy decisions and Standard Contractual Clauses are legal instruments, not technical controls. Schrems II invalidated Privacy Shield precisely because contract could not constrain surveillance law.
Why now
The infrastructure decision window is closing
The window in which sovereign infrastructure can be chosen rather than retrofitted is open — but it will not remain so. As cloud dependencies deepen and regulatory requirements tighten, the cost of transition rises. Organisations that choose sovereign infrastructure today avoid the repatriation cost their peers will face in five years.
“Data sovereignty is no longer a future concern. It is a clear and present danger. The question is not whether data will be collected, but under whose authority it will be governed.”
The convergence of five forces makes this the moment to act. Deferral is no longer a neutral decision — it is an accumulating liability.
1
Regulatory pressure is accelerating globally
UK GDPR enforcement has made data protection concrete — cumulative EU fines now exceed €4 billion. DORA came into force in January 2025 with binding ICT third-party risk obligations that directly implicate cloud and platform sovereignty, and FCA operational resilience rules are substantively aligned.
2
The geopolitical risk landscape has changed
Compelled access under the Stored Communications Act, FISA, and national security letters are precedents, not hypotheticals. US providers remain subject to US compulsion regardless of where data physically resides — and contractual assurance is a credibility gap regulators and boards are increasingly unwilling to accept.
3
AI adoption has expanded the attack surface
Regulated organisations are increasinly
4
Payments infrastructure is under simultaneous pressure
Faster Payments, FedNow, and the BIS G20 roadmap create millisecond-level flows that cross jurisdictional boundaries faster than any manual governance process can follow. APIgator enforcement at the data-in-motion layer supplies the technical control instead.
5
The infrastructure decision window is closing
Sovereign infrastructure can be chosen now rather than retrofitted later. As cloud dependencies deepen and requirements tighten, transition cost rises — organisations that choose today avoid the repatriation cost their peers will face in five years.
This is the lesson of GDPR, of SAMA, and of the mainframe: those who got ahead of the requirement kept control of their strategy.
Download the PDFGet the paper