Digital sovereignty, the simple version: the client owns the code, the database and the server

Microsoft, Forrester, Cloudflare and NVIDIA all wrote about data sovereignty in the same week: who controls your systems, where the encryption keys are kept, and whether everything keeps running if a provider or a regulator changes the rules. They write it for governments and regulated industries. But a company of thirty people faces the same question, “who owns my system,” and my answer has been the same since 2021: the code, the database, the server and the access credentials belong to the client.

What came out

On October 20, Microsoft described the next stage of its Sovereign Cloud in the Azure Blog: three levels of control for different workloads. Sovereign Public Cloud is for tasks that need more transparency inside Azure, Sovereign Private Cloud is for systems in the customer's own environment, including ones with no internet connection, and a partner ecosystem is for local operators. The specifics: Sovereign Control Panel goes into public preview at Ignite; in the EU and EFTA, Data Guardian adds European oversight of remote access by Microsoft engineers, and Production Touch Ledger keeps a tamper-proof record of those actions; external key management through Azure Managed HSM is now generally available, and the root key can be kept on your own hardware.

Forrester, on the same day, October 20, writes that sovereign AI now defines the market for sovereign cloud services: geopolitics, growing regulatory obligations and dependence on cloud and AI platforms are pushing technology leaders to cut outside dependencies. The note is short, and I won't dig into market details based on it.

Cloudflare on October 23 launched a post-quantum GeoKey Manager in closed beta: the decryption key is available only to servers in the chosen country or region, the protection is built on ML-KEM-768 combined with X25519, and Cloudflare rejects a request that lands in the wrong region. General availability is planned for the first quarter of 2027. A day earlier, on October 22, Cloudflare explained how it went through the Korean ISMS certification: ten days of audit, 80 controls, and in the end Cloudflare removed sign-in through Google, Apple and GitHub for users in South Korea, because there was no other way to show the four separate consents required by local law. The certificate is valid for three years with an annual check.

NVIDIA on October 21 expanded its family of open models: Nemotron 3.5 Super VL and Bolt, Nemotron Retriever for search and document parsing, Kumo for predictions on tabular data, Cosmos 3.5 for robots. The sentence from the post that matters most to me says the models can be fine-tuned on your own data and deployed on infrastructure you control.

Why a business owner should care

Take a car rental company. Bookings, contracts and inspection photos live in a rented service. The service triples its price, changes the export terms or shuts down. By contract the data is yours, but there is nobody to pull it out in a usable form and nothing to put it into. That is what losing sovereignty looks like without any geopolitics: someone else is managing the system your business runs on.

Microsoft solves this for ministries with Private Cloud and oversight of its engineers. For a company of thirty people the answer is simpler and cheaper: your own virtual machine, your own database, code in your repository and access credentials kept on your side. Out of everything on the Microsoft and Cloudflare lists, a mid-sized business needs one principle: the system keeps working without the vendor.

How I do it

For a very large holding company I built an application for tracking oil shipments and analyzing deviations, about $14,000 up to the beta version. It is deployed on the company's own servers and under its security requirements. The project is ongoing.

At a manufacturing company the task was closer to everyday life. The client wanted the parts and materials calculation program to be impossible to copy and carry off. So I moved all the business logic to a server on Node.js and Express, and the design engineers work only with the interface: a desktop app on Electron or a web version that opens only inside the company network and is restricted by ACL. Without access to the server, the client side calculates nothing. I handed the program over in summer 2024, and 11 people use it every day.

I have worked with a PDR company in the US since 2021, and there this rule has been in force since 2022, when I set up our own server on Debian in Google Cloud: the data is in a SQL database on the company's server, and the API, the website and the telephony are there too. All of it belongs to the client, and another developer could pick the system up.

As for open models: in late 2023, for a consulting company in London, I built a subtitle system on a local Whisper model: speech was recognized on our own server, with no cloud API involved, and nobody paid per minute of recording. I haven't tested NVIDIA's new models myself, but the path is the same.

What I would do

Check where the code lives. If it is not in your repository, ask for it to be moved there before the next payment to the contractor.

Write down every access credential: server, database, domain, email, cloud, CRM. Each one needs an owner inside the company; the contractor should never be the only person who has it.

Ask your SaaS vendor how to export all the data and in what format. If there is no answer, work out what your own virtual machine would cost.

For documents that are sensitive by law, find out which country they are stored in. Few companies will need regional keys, but you need to know the answer.

I wrote more about the server's role in a system in the article The server: data, access and process execution; about operations on the DevOps and infrastructure page, and about the business as one system on the internal systems page. Cases: technical partner to a PDR company and order calculation for manufacturing. From neighboring reviews: when your own server beats platforms on cost and zero trust for a 30-person company; earlier I wrote about contact center region and data residency. If you want to know which parts of your system belong to you, tell me how it is set up: Discuss your task.