For much of the cloud era, geography was becoming less important.
The promise of cloud computing was that businesses could access computing power, storage and applications wherever they needed them, without having to worry too much about the physical location of the underlying infrastructure. Workloads could move between data centres, capacity could be scaled almost instantly and organisations could access services from some of the world’s largest technology platforms without owning the infrastructure themselves.
That model still makes enormous sense. But the world around it has changed.
Regulation is becoming more demanding. Cyber threats are becoming more sophisticated. Geopolitical tensions are exposing the risks of excessive dependence on technology and infrastructure outside an organisation’s home market. At the same time, businesses are becoming increasingly conscious of where their most sensitive information resides and who ultimately has control over it.
This is driving growing interest in sovereign cloud but there is an important distinction to make from the outset: A sovereign cloud is about much more than putting your data in a data centre in the right country.
What is a Sovereign Cloud?
A sovereign cloud is a cloud environment designed to give an organisation control over where its data is stored and processed, who can access it, how it is protected and which legal and regulatory jurisdiction governs the environment.
Data residency is an important part of that. An organisation may require certain information to remain within the UK or another defined geographical area. Nigeria is the latest example, with banks, fintechs and other regulated financial institutions being required to begin moving payment and customer data to locally certified infrastructure.
But sovereignty can go considerably further.
Who operates the infrastructure? Where are the engineers and support teams located? Who has administrative access? Where are encryption keys held? Which legal entity owns and operates the service? What happens if a foreign authority attempts to obtain access to data? Can the organisation continue operating if a particular technology provider becomes unavailable?
These are all sovereignty questions.
That is why data sovereignty and data residency are not necessarily the same thing. A provider can guarantee that your data is physically stored within a national boundary without necessarily giving you the degree of operational, legal or technological control that genuine sovereignty requires.
For some organisations, simple data residency may be sufficient. For others – particularly those operating in government, financial services, healthcare, defence, critical infrastructure or highly sensitive commercial environments – it may not be enough.
Sovereignty is therefore better understood as a spectrum. The appropriate level depends on the organisation, its workloads, its regulatory obligations and its appetite for risk.
Why does sovereign cloud matter now?
The growth of sovereign cloud reflects a much wider change in the way organisations are thinking about technology.
Cloud was once primarily an IT infrastructure decision. Increasingly, it is becoming a question of business resilience, risk and strategic control.
Governments are strengthening requirements around data protection, cyber resilience and critical infrastructure. Businesses are becoming more aware of the potential consequences of their data being subject to laws outside their own jurisdiction. And recent geopolitical events have demonstrated how quickly relationships between countries, technology companies and global supply chains can change.
The result is a reassessment of some of the assumptions that accompanied the rapid adoption of public cloud.
This doesn’t mean organisations are abandoning public cloud. The scale, flexibility and breadth of services offered by hyperscale cloud platforms remain extremely attractive.
The question is becoming more sophisticated: Which workloads should be in conventional public cloud, and which require a greater degree of sovereignty and control?
That is leading more organisations towards hybrid strategies, combining public cloud with private cloud, dedicated infrastructure and sovereign environments.
The objective isn’t to turn the clock back to traditional IT. It is to make sure that the benefits of cloud don’t come at the expense of control.
Sovereignty is about more than the Data Centre
It is tempting to think of sovereignty as a geographic problem. If the requirement is for data to remain in the UK, simply choosing a UK data centre might appear to solve the problem.
It doesn’t necessarily.
Consider what happens around that data. It may be processed by systems elsewhere. Backups may be replicated to another jurisdiction. Technical support may be provided by engineers based overseas. Management platforms may be operated from another country. Encryption keys may be controlled by a third party. The company providing the service may itself be subject to laws in another jurisdiction.
None of this automatically makes an environment unsuitable. But it does demonstrate why the phrase “UK-hosted” or “overseas-hosted” doesn’t, by itself, establish sovereignty.
A genuinely sovereign architecture needs to consider the entire environment: infrastructure, networks, data, security controls, management systems, people, access permissions, backups and disaster recovery.
The same principle applies to resilience. A primary cloud environment may meet sovereignty requirements perfectly, but if its recovery platform sits outside the required jurisdiction, the organisation could discover that its disaster recovery strategy introduces a sovereignty gap precisely when it is needed most.
Sovereignty and resilience therefore increasingly belong in the same conversation.
The Legal Dimension
There is another layer that organisations need to consider: legal jurisdiction.
The location of a server is not necessarily the same thing as the jurisdiction of the organisation operating that server.
Organisations therefore need to understand not only where their data physically resides, but also which legal entity provides the service, which laws govern the relationship and what protections exist against external demands for access.
This can become particularly complex when global technology providers are involved. A cloud environment may be physically located within a country while the wider corporate and legal structure extends well beyond it. For organisations with particularly sensitive workloads, that distinction can be important.
The answer isn’t necessarily to avoid global cloud providers altogether. Rather, it is to understand exactly what sovereignty means for the workload and whether the chosen architecture can demonstrably deliver it.
That requires considerably more due diligence than simply selecting a cloud region from a drop-down menu.
Sovereign does not mean isolated
There is another misconception worth challenging. Sovereignty does not necessarily mean isolation.
Most organisations don’t want to disconnect themselves from the wider cloud ecosystem. They want to use the technology that best suits their business while retaining control over the workloads and data that require it.
A business might therefore choose to keep particularly sensitive customer information or intellectual property on dedicated infrastructure within its home jurisdiction, while using a hyperscale public cloud for other applications. Secure, dedicated connectivity can then allow the different environments to operate together.
That is where hybrid cloud becomes particularly powerful. Sovereignty doesn’t have to mean creating a completely separate technology universe. It can mean creating a controlled environment within a wider cloud strategy.
This also means that sovereignty does not necessarily require an organisation to choose a single cloud provider. Different workloads may have different requirements, and businesses may still want access to the functionality, innovation and scale offered by different cloud platforms.
The challenge is making those environments work together securely, reliably and efficiently. That is as much an architectural and operational challenge as it is a technology one.
Choosing a sovereign cloud provider
As sovereign cloud becomes more mainstream, the terminology itself is becoming increasingly common in technology marketing.
That makes it more important for organisations to look beneath the label. A good starting point is to ask some straightforward questions.
Where is the infrastructure located? Who owns and operates it? Where are the primary and recovery environments? Who can access the systems? Where are operational and support teams based? Who controls encryption keys? How is data protected when it moves between systems? Which legal entity provides the service? And what happens if that provider can no longer deliver the service?
The answers will help determine whether an environment is genuinely sovereign or simply hosted within the right geography.
The provider should also be able to demonstrate how sovereignty is maintained throughout the life of the service. That includes day-to-day management, security monitoring, patching, upgrades, capacity planning, backup, disaster recovery and eventual technology replacement.
This is an important point because sovereignty isn’t something that can simply be switched on when a workload is deployed. It needs to be built into the architecture and maintained throughout its lifecycle.
There is also a practical consideration. Sovereignty requirements can add complexity and cost. Dedicated infrastructure, additional security controls and in-country recovery arrangements all have operational implications.
That makes experience important. The right provider should be able to help an organisation establish what actually needs to be sovereign, rather than simply selling the most restrictive – and potentially most expensive – solution available.
Where vXtream fits
For vXtream, this is where our own infrastructure and managed services experience becomes particularly relevant. We operate infrastructure in both the UK and Switzerland, providing a foundation for organisations that need greater control over where their cloud environments and data reside.
But infrastructure alone isn’t enough.
Sovereign cloud requires expertise across the entire environment – from data centre and cloud infrastructure through to connectivity, security, data management and operational support.
That is why vXtream’s approach isn’t based on a single cloud platform.
We can combine dedicated infrastructure, private cloud and major public cloud services, connecting them through secure network infrastructure to create an environment designed around the customer’s requirements. That flexibility matters because sovereignty isn’t an identical requirement for every workload.
Some data may need to remain entirely within a particular national boundary. Other workloads may be perfectly appropriate for a major public cloud. Some organisations may need dedicated infrastructure for their most sensitive systems while still wanting access to the scale and innovation available from hyperscale platforms.
The answer is therefore unlikely to be “one cloud for everything”. It is more likely to be the right cloud architecture for each workload, with sovereignty built in where it matters.
This gives organisations greater choice without forcing them to sacrifice control. They can determine which workloads need the strongest sovereignty protections, where those workloads should run and which cloud services make sense around them.
That is where a managed services provider with its own infrastructure can add real value: providing the expertise to design and operate the environment without requiring the customer to build every element themselves.
The next stage of the cloud journey
The cloud market is entering a new phase. The first stage was about moving away from owned infrastructure. The second was about exploiting the extraordinary scale and flexibility of hyperscale cloud.
The next stage is likely to be more nuanced. Organisations will increasingly choose infrastructure according to a combination of factors including performance, cost, security, resilience, regulatory requirements and sovereignty.
That doesn’t make public cloud obsolete – it makes choice and control more important.
Sovereign cloud will be an increasingly important part of that strategy, but organisations should be wary of treating it as simply another product category. It is an ecosystem of infrastructure, data, connectivity, security, people, governance and legal control – designed to give an organisation confidence that its most important digital assets remain within the boundaries it has chosen.
Ultimately, the questions are simple: Where is my data? Who can access it? Who controls the infrastructure? Which laws apply? And can I continue to operate if the world around my technology provider changes?
Those questions are becoming too important to leave to cloud marketing.
For organisations that need greater control over their digital infrastructure, sovereign cloud offers a way to retain the benefits of cloud while strengthening that control.
And with its own infrastructure in the UK and Switzerland, combined with expertise across cloud, connectivity, security and managed services, vXtream is well positioned to help organisations build sovereign cloud environments around what matters most: control, resilience and trust.
Want to understand what sovereign cloud could mean for your organisation? Talk to us today.
Image: © Daria Agafonova, Pexels