Sovereignty · Concepts
What do we mean by sovereignty?
Sovereignty comes in degrees. It is about control: who can access your data, who runs the platform, and whether you can leave when you want to.
Where your data lives and who decides over it are two different questions.
Storage location
The physical location of your data: a data centre in the Netherlands or elsewhere in the EU. A good start. Who can compel access to it depends on the jurisdiction of the provider.
Sovereignty
Control over your data. It follows the law of the provider: a US provider with a data centre in Amsterdam is subject to US law such as the CLOUD Act. With a European provider, control stays in Europe.
Four dimensions
Sovereignty has several sides
A platform is as sovereign as these four dimensions together. That is why we always look at them as a whole.
Legal
Which jurisdiction does the provider fall under, and can a foreign government compel access? What counts is where the provider has its headquarters.
Operational
Who operates the platform, and from which country? Who holds the encryption keys? A European operations organisation adds to this.
Technological
Is your data stored in open formats, and can you switch vendors while keeping what you have built?
Organisational
Do you know what data you have, how sensitive it is and who can access it? With that overview you make deliberate choices about where your data belongs.
A rising scale
Every dataset at the level that fits
European assessment frameworks work with increasing levels. We use a simple scale to make the right choice per workload:
- Level 1Data in the EU. The servers are in Europe. Provider and operations may also come from outside the EU.
- Level 2Plus your own keys and European operations. You manage encryption yourself and the platform is operated from Europe.
- Level 3Plus a European provider. The whole platform falls under European law, with a European parent company.
- Level 4Plus open formats and a tested exit. You can demonstrably leave, to another provider or to your own infrastructure.
This scale is our own simplification, meant to guide the conversation. In a sovereignty scan we also assess against the frameworks that apply to your organisation.
Our view
The exit is the real test
Contracts, certificates and data centre locations are promises. Real control shows itself when you want to leave.
That is why we start with the technological side. With data in open formats, every other choice stays reversible: switching provider, moving operations or bringing a workload back in-house.
And we are pragmatic. Every workload gets the level that fits, and you know exactly where you stand and what the next step costs.
What level is your data platform at?
A sovereignty scan answers that per workload, with a concrete route to the level you need.