Essay·2026.02·9 min read
Sovereignty is doing real work in our customer conversations. The word is starting to lose meaning. Here is how we test for it.
Where does data physically reside?
First-order question. EU/EEA only? Specific Member State? Both at rest and in transit, and including any vendor sub-processors?
Who holds the keys?
Customer-managed keys, in customer KMS, on customer hardware. Anything else is a posture, not sovereignty.
Whose law applies to the operator?
If the operator is subject to extraterritorial legal obligations — voluntary or otherwise — the data is reachable. Sovereignty asks the operator's jurisdiction directly.
Can you exit?
A sovereign relationship is one you can leave on your terms. Open formats, time-bounded export, and contractual purge are the test.