What sovereignty actually means in the public cloud

When people talk about sovereignty in the cloud, the conversation almost always starts with geography.

When discussing this we often hear “Does our data stay in Sweden?” or “Is it stored inside the EU?”. These are reasonable questions. They are just not the full story.

Sovereignty is not primarily about where data sits. It is about control and accountability.

For organizations consuming cloud services, sovereignty is the ability to clearly answer three basic questions.

The three questions that define sovereignty

1. Who is in control of the data and the systems? Who ultimately decides how systems are configured, operated, changed, or shut down.
2. Who can access or operate them, and under which laws? Who has technical access, operational authority, or legal reach if something goes wrong.
3. What does the business depend on to keep running? Which external services, networks, or decisions must exist for operations to continue.

If these questions cannot be answered clearly, sovereignty is assumed rather than understood.

Why location alone is not enough

It is entirely possible for data to be physically stored in Sweden or elsewhere in the EU and still not be sovereign in practice.

Data location alone does not automatically answer:

• Who can technically access the systems
• Who operates and maintains the platform
• Which laws apply to operators and vendors
• What happens if connectivity, services, or support is disrupted

Sovereignty is about control under real conditions, not just during normal operations.

The trust question in Europe

In Sweden and across the EU, sovereignty discussions are increasingly shaped by a broader trust issue.

Microsoft, Amazon, and Google are all US-based companies. Regardless of where data is stored, these providers themselves operate under a foreign legal and political sovereignty.

This creates understandable concern for public sector organizations and regulated industries:

• What legal obligations apply to the provider if a foreign authority makes a request?
• What happens if geopolitical conditions change?
• What level of dependency is acceptable for critical systems?

For many decision-makers, the concern is not technical. It is institutional and legal.

An example

Consider a Swedish public authority using a public cloud service.

The data may be stored in an EU datacenter. Access may be restricted. Encryption may be strong.

But if:

• The control plane is operated from outside the EU
• Platform operations depend on continuous connectivity to global services
• Support, updates, or security decisions are made under foreign jurisdiction

Then sovereignty becomes conditional.

The question is no longer “Where is the data?” It becomes “Who is in control if something happens?”

What sovereignty means in public cloud terms

In a public cloud, sovereignty does not mean that no external provider is involved. It means understanding and actively managing the relationship with that provider.

In practical terms, public cloud sovereignty is about:

• Transparency around roles and responsibilities
• Clear boundaries for access and operations
• Legal clarity around jurisdiction and accountability
• Awareness of operational dependencies

You are not asking: “Is this cloud foreign or local?”

You are asking: “Who can do what, under which conditions, and what do we depend on?”

The questions non-technical leaders should ask

Sovereignty is not an IT problem. It is a governance problem.

Non-technical leaders should be asking:

• If there is a crisis, who has the authority and technical capabilities to act on our systems?
• If connectivity is lost, what continues to work and what stops?
• If regulations change, do we have options or are we locked in?
• If trust is questioned, can we prove who controls what?

These are business questions. They just happen to involve cloud services.

Sovereignty is a spectrum, not a switch

A common misconception is that sovereignty is binary. Either you have it or you do not. In reality, sovereignty exists on a spectrum.

Different workloads require different levels of control:

• Some can operate with shared responsibility and external dependencies
• Others require tighter operational, legal, or physical control
• Some must continue running even if disconnected or intentionally isolated

Understanding sovereignty means understanding which level of control is appropriate where.

Setting the stage

This article is the first part of a series.

The purpose here is to establish a shared understanding:

• Sovereignty is about control, accountability, and dependency
• It applies to public cloud usage, not just private environments
• It is a business concern first, and a technical concern second

In the next part, the focus will go into details on the technical controls that make sovereignty real in a public clouds

Originally published on LinkedIn on March 18, 2026.