Real Data Sovereignty Is About Keys and Access, Not Geography

By Marcus Bennett

Sovereign cloud regions store European data on European soil, yet a single US statute — the CLOUD Act — can still compel a US-owned provider to hand that data over. That gap between where data sits and who can reach it is the practical problem finance leaders now have to price into their cloud strategy.

Why does the CLOUD Act matter more than data location?

The CLOUD Act lets the US government request customer data from a US-owned service even when the data is held in the EU. Those requests are meant to pass through the criminal court system. "When it lands in Europe it headbutts with GDPR and you're involved in legal wrangling as to whether or not that data can be released," IDC research director Rahiel Nasir says.

Nasir views the Foreign Intelligence Surveillance Act (FISA) as more problematic still, because it bypasses criminal courts. "That's an executive order," he says. "They'll just take whatever they need." No number of sovereign public cloud regions changes that exposure while a US parent company controls the encryption keys.

How are the hyperscalers responding?

Under its EU Data Boundary, Microsoft stores and processes EU customer data — including support logs for core cloud services — inside the EU. AWS makes similar commitments for its European Sovereign Cloud, claiming no critical dependencies on infrastructure outside the EU, and like Salesforce employs EU-based support staff. Google and Oracle run comparable dedicated sovereign regions, with more jurisdictions planned.

Microsoft has tightened access controls. Most admin and support tasks run through automated, audited workflows, and staff hold no standing access to customer content, says Douglas Phillips, president and CTO for Microsoft specialized clouds. Customers can approve or reject individual access requests for Microsoft 365, Azure, Dynamics 365 and Power Platform data. "Approved access is customer-controlled, limited, time-bound, and audited," he says.

A new Data Guardian option puts remote access by Microsoft engineers under oversight of an EU partner with EU-based staff, with tamper-evident records stored in a Production Touch Ledger, rolling out across the EU and EFTA.

What does key control actually cost?

"The hyperscalers have made their key management capabilities easier for organizations to use as a direct result of their sovereign needs," Nasir says. Google, AWS, Microsoft and Oracle all tell customers they own the data and manage the keys. But that mirrors the shared responsibility model of the cloud: it only works if you staff for it. "You're going to recruit the staff who can manage that task for you," Nasir says. "It's down to the organization having the skill level."

Going further — private cloud with hardware security modules for key storage — costs even more. "A government agency, defence contractor, or large, highly-regulated enterprises like financial services can afford those costs because it's not a one-time project," says Kiteworks EMEA GM Dario Perfettibile. "There are ongoing costs." Scality CMO Paul Speciale argues most companies instead need the ability to control and revoke access to sensitive data independent of any vendor's staff.

Confidential computing (protecting data in use, not just at rest) adds another layer. Gartner predicts that by 2029 more than 75% of operations on untrusted infrastructure will use it. Azure, AWS, Google and IBM already offer confidential VMs, enclaves and encrypted databases; VAST has launched a secure container runtime for AI workloads. "AWS is powered by the Nitro System, which enforces access restrictions so nobody, including our own employees, can access customer data running in Amazon EC2," AWS's Harry Staight says.

How much sovereignty is too much?

Extreme isolation has a measurable price. FedRAMP, the US government framework, costs up to a hundred times more than comparable commercial cloud, says Fastly CTO Artur Bergman — and while Amazon CloudFront runs hundreds of points of presence globally, only two serve FedRAMP. Staffing is another constraint: Sweden bans midnight-to-5am shifts unless a service is deemed essential, and Germany's regulated working hours raise on-call costs.

What should CFOs do now?

More regulation is coming. The EU's planned Cloud and AI Development Act (CADA) follows the CLOUD Act concerns and a Canadian court ordering OVHcloud to produce data held in France, and the EU–US Data Privacy Framework itself may be annulled. Perfettibile's advice: "You have to build on what you have today, not think about what's happening tomorrow, because security won't wait until tomorrow."

The realistic path, per Phillips and Nasir: match each workload's regulatory and risk profile rather than applying maximum isolation everywhere. Start with data classification and tagging — after years of hoarding, many firms hold petabytes with no clear idea what is inside. That is a data management problem, not a sovereignty problem, and fixing it is the cheapest control on the table.