Data Residency Is a Read-Path Proxy, Not Sovereignty

The most useful admission in the sovereign cloud market is buried in a warranty.

Microsoft and AWS have both committed to legally contest any order that would suspend their services in Europe, and to compensate customers financially if data is disclosed in violation of the GDPR. Stanford HAI reads those commitments for what they structurally are: an admission — implicit in some cases, explicit in others — that sovereignty overlays do not remove jurisdictional exposure to the United States [1].

Read that as a procurement assurance and it is reassuring. Read it as an architect and it is a disclosure. A provider promising to litigate an order is conceding that the order can reach it. A provider promising to compensate you for a disclosure is pricing the disclosure, not preventing it. Both are honorable commitments. Neither is a control property. You cannot indemnify your way to sovereignty, because the thing being indemnified is the exposure you were told the architecture had eliminated.

The tiers are a ladder on one axis

Stanford HAI sorts hyperscaler sovereignty offerings into three tiers, and the sort is instructive [1].

Tier 1 keeps the hyperscaler in full ownership and operation while layering software-based sovereignty controls on top — data boundaries, confidential computing, in-region processing guarantees that reach past storage into processing and administrative access.

Tier 2 changes who operates. A local legal entity runs the infrastructure and manages administrative access using hyperscaler technology, creating a jurisdictional shield against extraterritorial requests of the kind the U.S. CLOUD Act enables. France’s S3NS, majority-owned by Thales on Google Cloud, and Bleu, a French joint venture on Microsoft Azure, both pursue SecNumCloud qualification, under which data remains subject to European jurisdiction and law. Data-guardian features can restrict administrative access to personnel physically located inside the EU boundary. AWS’s European Sovereign Cloud sits adjacent rather than inside this tier: physically and logically separate, staffed by EU-resident personnel, but wholly owned through German subsidiaries — which the brief reads as a narrower jurisdictional shield than the partner-owned models.

Tier 3 disconnects entirely. Air-gapped, standalone environments on-premises or in secure facilities, run by cleared local staff, adopted for national security and critical infrastructure.

That is a real ladder, and each rung buys something a serious architect should want. But notice what the rungs are measuring. Every one of them answers the same question with increasing rigor: where are the bytes processed, and under whose law? Tier 3 answers it maximally by severing the connection. None of the three rungs answers a different question: who controls the decision the system makes?

The ladder is tall. It is also a single axis. Climbing it does not move you along the second one.

The one control primitive in the stack, and where it stops

The market’s best counterexample lives inside Tier 1, and it deserves credit precisely because it is the shape of the right answer.

Microsoft’s Sovereign Public Cloud lets customers hold encryption keys outside Microsoft’s cloud and revoke access at any time, rendering the data unreadable to Microsoft and adding protection against extraterritorial access [1]. That is not a location guarantee. It is a revocation primitive — a control the customer exercises unilaterally, whose effect does not depend on the provider’s cooperation or a court’s disposition. It is a genuine write-path control at the data layer.

Now ask where the equivalent primitive is for a proprietary model consumed as a hosted service. You cannot hold those weights outside the provider’s environment. You cannot revoke the provider’s access to its own model. You cannot inspect the function that produced a decision, modify it, or reproduce it after the provider deprecates the version. HAI makes the general form of the point about localized proprietary access: it may increase reach, but it does not permit inspecting or modifying the underlying system [1].

So the stack offers a customer-held key at the storage layer and, for proprietary hosted models, nothing structurally comparable at the decision layer. That asymmetry is the whole subject of this post. Residency has matured into something auditable and, in places, genuinely controllable. Decision control has not matured at all in the same offerings.

Where the write path actually is

The prologue drew this line from McKinsey: sovereign cloud concerns where data is stored; sovereign AI concerns how intelligence is created, trained, and deployed [2]. The first is a property of infrastructure. The second is a property of the decision.

The software-architecture literature puts the same claim in quality-attribute terms. The ICSE-Companion Sovereign Reference Architecture argues sovereignty must be treated as a “first-class architectural property” rather than a purely regulatory objective, and its constituent elements are decision-layer concerns — sovereign data governance and generative AI deployed under explicit architectural control, not data placement [3]. Cruzes reaches a compatible conclusion from the infrastructure side: control over data and algorithms alone is no longer sufficient, because practical sovereignty depends on the capacity to deploy, operate, and adapt under real constraints [4].

Three literatures, three vocabularies, one boundary. Everything on the read path is about custody. Everything on the write path is about control.

The write path has its own primitives, and they are unglamorous. Own the weights, or own a substitute. HAI notes that open-weight models — released such that they can be run, fine-tuned, and inspected independently of the developer — are a common and meaningful route to lower dependency specifically at the model layer, with Mistral and Aleph Alpha among the developers releasing openly; it also notes, correctly, that running them at scale still requires proprietary hardware and cloud, so they reduce rather than eliminate upstream dependency [1]. That is the honest ceiling, and it is still a categorical improvement: a model you can host and inspect is a decision you can defend.

Record the decision. An architecture that cannot reconstruct why it decided what it decided has no evidence to offer anyone. Gartner’s read of the coming liability environment lands on exactly this: explainability and clean data are becoming non-negotiable as legal claims over AI-mediated harm accumulate [5]. A decision trace is not documentation. It is the artifact that converts a claim of control into a demonstration of it.

Keep the decision substitutable. If the model behind a consequential decision cannot be replaced without re-architecting the system, the provider holds a control property that the residency audit will never surface.

Next: the kill-switch — what happens to a decision path when a provider declines, withdraws, or is directed to stop, and why a single frontier-API dependency is an availability guarantee written by someone else.