Data residency and data sovereignty are not the same thing

Residency answers "where"; sovereignty answers "who controls"

Data residency is about location: the bytes are stored in a given country. Data sovereignty is about control and jurisdiction: who can compel access, where the processing happens, and whose law governs the keys. The two often get merged in marketing, and the gap between them is where surprises live.

We made a related point in sovereignty is not a server location: a local data centre owned and operated under foreign control is not the same as sovereign infrastructure.

Why the difference bites

Residency without sovereignty leaves open questions that only appear under pressure:

• Can a foreign parent company or court compel access to resident data?
• Does inference leave the region even if storage does not?
• Who holds the encryption keys, and under which jurisdiction?
• Can the provider change these terms without your consent?

What sovereign actually requires

Real sovereignty means the data stays in-region, inference runs on infrastructure you control, the keys sit under your jurisdiction, and the system can operate offline if the link to the outside world is cut. Residency is one necessary piece of that, not the whole of it.

For regulated industries and the public sector, this is not a philosophical point. It is the difference between a control you can demonstrate to a regulator and one you merely assert.

Ask the stronger question

When a supplier says "sovereign", ask them to separate the two claims: where does the data live, and who controls access, processing and keys? If the answers are only about location, you have residency, not sovereignty. See how we approach sovereign AI, or put the question to us directly.