Ask most enterprises whether their data is sovereign and they will usually point to the cloud region they chose, such as Frankfurt or EU-West. Computer Weekly asked ten storage and backup vendors and a commercial lawyer whether that is enough. All of them said no. Tiger Technology's founder and CTO, Alexander Lefterov, was one of the contributors. Below is a short summary of the key points and his perspective.
Why a cloud region falls short
A server in Frankfurt says nothing about who can be legally compelled to hand over the data on it. Lefterov pointed to the US CLOUD Act, which lets American authorities require US-owned providers to produce data stored anywhere in the world, including the EU, without notifying the customer. In his view, location was a reasonable proxy for control before cloud. Cloud broke that proxy.
What control actually requires
The interviewed experts agreed on what real control looks like: who holds the encryption keys, who governs lifecycle and deletion policies, and whether an organization can operate independently of a single vendor or jurisdiction. They also noted that global rules are diverging rather than converging. GDPR, China's Data Security Law, India's DPDP Act and a fragmented US state landscape mean that a single global cloud architecture is no longer a safe assumption for multinational organizations.
Encryption helps, but only as one layer
Lefterov sees value in confidential computing for sensitive workloads, but noted it leaves gaps: data at rest over decades, key management, and what happens if a provider exits the market. His advice is to get the foundation right first: lifecycle governance, key ownership and vendor independence.
"Location was always a proxy for control. Once you moved to the cloud, that proxy broke. You need to ask: who governs the encryption keys, the lifecycle policies, the deletion? If those answers lead back to a foreign-owned entity, you have a sovereignty gap."
Alexander Lefterov, Founder & CTO, Tiger Technology
Read the full feature on Computer Weekly: The geography trap: Why a cloud region is no substitute for data sovereignty
Also published in
The two-part analysis was picked up across Europe and the Middle East:
- Manage IT (Germany) — Datenresidenz und Datensouveränität im Zeitalter der KI
- CyberSecurity News (Belgium) — Why the geographical choice of a cloud is no longer a sovereign strategy with AI
- Digitalisation World (UK) — part one and part two
- Silicon Valleys Journal — part one and part two
- Tech Novice (German) — Datensouveränität im Zeitalter der KI: Warum der Speicherort allein nicht reicht
- Storage Insider (German) — Der reine Speicherort ist nicht entscheidend