Data Sovereignty Is an Infrastructure Problem

Data sovereignty has moved to the top of the priority list for IT organizations worldwide. Most of the conversation treats it as a data storage problem: which disk, in which country, holds the files. Data sovereignty is an infrastructure problem. It touches compute, storage, networking, and the software that manages it all, and the key to both building and maintaining a secure, sovereign data center is simplifying that software. The more layers of the IT stack an organization collapses, the easier the data center is to operate and the easier it is to prove that the data inside it stays under the organization’s control.

Key Takeaways

• Data sovereignty is an infrastructure problem that reaches compute, storage, networking and the software that manages them.
• Residency puts data inside a country. A provider under another country’s jurisdiction can still be compelled to hand over the data and its keys.
• Data center inflation raised memory, flash and server prices in 2026 for owners and cloud renters alike, which makes repatriating steady-state and regulated workloads attractive.
• Sovereign infrastructure software needs simplicity, disconnected operation, networking that controls data movement, in-house keys, GPU support and secure nested multitenancy.
• Midsize enterprises gain the most from collapsing the stack, since a three-to-five-person team has no headcount to spare for a sovereignty program.

The challenge in 2027 is meeting sovereignty requirements on top of everything else IT is already dealing with. Teams are searching for a VMware alternative, hardening their defenses against ransomware, and working out where AI fits. Sovereignty shows up as another project competing for the same small staff and budget.

Key Terms

Data Residency

The physical location of data inside a country’s borders. Residency says where data sits, and nothing about who can compel access to it.

Data Sovereignty

Physical and jurisdictional control over data, so only the laws and people the organization accepts can reach it.

CLOUD Act

A 2018 US law that lets US authorities require companies under US jurisdiction to produce data they hold, wherever that data is stored.

Confidential Computing

CPU features such as AMD SEV-SNP and Intel TDX that encrypt data in memory to protect it from the hosting provider’s own administrators.

Disconnect Drill

A test that cuts every outside connection and then runs normal operations, including a patch cycle and a restore, to expose hidden external dependencies.

Default-Deny Outbound

A network policy that blocks all outbound traffic unless an explicit rule allows it.

Nested Multitenancy

Tenants that contain their own sub-tenants, each with its own compute, storage, network, administrators and data placement policies.

Sovereignty is particularly hard for midsize enterprises. A large enterprise can throw money and people at the problem. It can staff a dedicated sovereignty team, build separate data centers in each jurisdiction, and pay specialists to stitch together and audit a dozen products. A midsize enterprise runs its entire data center with a three-to-five-person IT team that already owns virtualization, storage, networking, backup, and the help desk. That team has no spare headcount for a sovereignty program and no budget to duplicate infrastructure in every country where the business operates. For midsize IT, collapsing the stack is the most practical path to sovereignty.

Data Residency Is Not Data Sovereignty

Data residency typically means the data is physically located inside a country’s borders. The problem is ownership. If a provider under another country’s jurisdiction owns or operates the facility, that provider can be compelled to turn over the data, along with any encryption keys it holds. The US CLOUD Act, for example, reaches data held by companies under US jurisdiction wherever that data is stored. Moving a workload to a European region of a US provider changes the data’s address. The legal exposure stays exactly where it was.

Data sovereignty means maintaining both physical and jurisdictional control over the data. An organization that wants to keep using a provider has to adopt an encrypt-everywhere philosophy. Encryption has to run on the network and inside the CPU, using confidential computing features that protect data in memory from the provider’s own administrators. That approach works, but it requires the latest generation of processors and adds a layer of key management the organization must run itself.

Bringing operations in-house changes the math. When the organization controls the facility, the hardware, and every network path out of the building, it can stop exfiltration directly. The need for always-on encryption relaxes, and encryption at rest and during transmission to remote sites is often enough.

Why On-Premises Makes Sense Again

The appeal of the cloud was that buying and managing infrastructure became the provider’s problem. For years, renting IT services as an operating expense made sense. Hardware got cheaper and faster every year, so waiting meant buying better hardware for less money. That changed in 2026. Data center inflation arrived as memory and flash prices climbed sharply, with AI build-outs absorbing supply, and server prices followed. Cloud providers buy from the same suppliers, so renting offers no escape from component inflation.

Inflation also changes how IT should treat the hardware it already owns. For most workloads, the storage and compute in today’s data center have delivered more than enough performance for the last five or six years. That hardware is fast enough. New hardware is simply no longer cheap enough to treat as disposable, and extending the life of existing servers becomes one of the most direct ways to control infrastructure cost.

Combine those economics with data sovereignty concerns, and the cloud loses much of its appeal. The organization pays a premium to rent hardware whose price is rising, pays egress fees to move its own data, and accepts the provider’s jurisdiction as part of the deal. Sovereignty requirements add to the bill.

Now is the time to slow cloud migrations and even repatriate some workloads already moved. Steady-state workloads with predictable demand are the clearest candidates. They gain the least from cloud elasticity and cost the most to rent month after month. Workloads that touch regulated data come next, and bringing them home removes the jurisdiction question entirely. The cloud still fits bursty demand and short-lived projects. The change is that on-premises becomes the default for any workload where control matters, and the cloud becomes the exception.

What Sovereign Infrastructure Software Requires

The key to making on-premises computing feasible again is simplifying Day 2 (and Day 367) operations. With rising hardware costs, infrastructure software must also improve efficiency by running more workloads on existing hardware and provide flexibility, keeping any server usable for ten years or more.

Simplicity

Sovereign infrastructure software has to let the organization run on-premises workloads as easily as it runs them in the cloud. That means eliminating the legacy stack of separate software and hardware tiers. The compute tier is physical servers managed by a virtualization package. The storage tier consists of external arrays, each running proprietary software from its vendor. The networking tier is a collection of switches, routers, and firewalls managed by another proprietary software stack. Each tier has its own console, update cycle, license, and often its own connection back to its vendor. A single infrastructure operating system collapses those tiers into one layer with one console, one update cycle and one license, and it gives a sovereignty audit far fewer places to look.

Disconnected Operation

The second requirement is the ability to run in a disconnected state. If the software requires a continuous connection to an external provider, someone outside the organization’s jurisdiction can shut down that connection and leave the organization unable to operate. The risk extends well past the public cloud. Many on-premises products check in with the vendor for license validation, host their management console in the vendor’s cloud, or stream telemetry back to the vendor around the clock.

IT needs to verify that every component, including the management plane, licensing, and software updates, keeps working with no outbound internet connection. The most reliable test is a disconnect drill. Cut every outside connection, then run normal operations, including a patch cycle and a restore. Anything that breaks during the drill is a sovereignty dependency that needs to be fixed or replaced.

Networking That Controls Data Movement

Sovereign infrastructure needs strong networking capabilities that detect and block exfiltration and make infiltration very difficult. Default-deny for outbound traffic is the starting point. When nothing leaves the environment without an explicit rule, IT can prove that no component is reporting back to a vendor, and an attacker who gets inside finds no easy path out with the data. Microsegmentation between workloads limits how far an intruder can move. The management network belongs on its own isolated segment, as it holds the keys to everything else in the data center.

Core services belong inside the boundary as well. DNS, identity, and certificate services that depend on an outside provider become one more kill switch. When a vendor needs access for support, IT grants it per session, records it, and closes it when the work is done. All of this is far easier to deliver when networking is part of the infrastructure operating system, not a separate stack of appliances with its own management software.

Encryption at Rest and In Flight

Being on-premises lightens the need to encrypt data as universally as an organization that tries to maintain a cloud presence. It also weakens the case for buying new CPUs just for confidential computing features like AMD SEV-SNP and Intel TDX. In a facility the organization owns, the untrusted hosting provider is gone, and the existing servers stay in service longer.

The encryption keys stay in-house regardless. Whoever holds the keys can be compelled to hand them over, so the organization generates and stores its own and keeps them off any supplier-managed service.

AI Hosting

The platform should be able to host AI. That requirement has nothing to do with the infrastructure software becoming an AI vendor. It means the platform provides proper GPU support, including pooling GPUs across hosts, partitioning a single GPU with NVIDIA Multi-Instance GPU (MIG) so several workloads share it, and isolating those workloads from one another.

Private AI is a sovereignty question. Prompts, model outputs, retrieval data and fine-tuning data all qualify as regulated data, and running inference on GPUs the organization owns keeps every one of them inside the boundary. GPUs are also expensive and hard to get, so pooling and partitioning matter as much as basic support.

Secure Nested Multitenancy

Finally, the platform should support secure, nested multitenancy, letting the organization manage data sovereignty by workload group. Workloads arrive with different requirements. Data from German customers, a defense contract, and an internal HR system each answer to different rules. Nested tenants turn those rules into infrastructure. Each tenant gets its own compute, storage, and network resources; its own administrators; and its own policies for where data and replicas can reside.

A tenant can contain its own sub-tenants, so a business unit or in-country operation can manage its slice of the environment without seeing anyone else’s.

Simplicity Is the Path to Sovereignty

The technology to achieve data sovereignty exists today. The obstacle is assembling and running it.

A single infrastructure operating system that integrates compute, storage, networking, data protection and GPU support, and runs fully disconnected, gives IT fewer things to secure, fewer things to staff and fewer things to prove. The same platform addresses the VMware exit, ransomware resilience and private AI. Sovereignty stops being another project on the list and becomes the result of better architecture.

Full disclosure: I founded Storage Switzerland, and today I work at VergeIO, the company behind VergeOS.

VergeOS from VergeIO is one example of this approach. It integrates virtualization, storage, networking and data protection into a single code base, managed from one interface that runs inside the organization’s own data center. Its Virtual Data Centers (VDCs) deliver the secure, nested multitenancy described above. Each VDC gets its own compute, storage, network and administrators, and VDCs can nest inside one another to match business units or jurisdictions. Built-in snapshots and replication keep data protection and disaster recovery inside the same platform, moving copies only between sites the organization controls. VergeIQ adds private AI with GPU support on hardware the customer owns.

VergeOS also runs on a wide range of existing x86 servers, including mixed generations in the same environment, which extends hardware life. For a midsize enterprise, that combination lets the same small team run a sovereign environment at every site sovereignty requires, with one product, one console and one vendor relationship in place of a separate stack for each layer.

To see how organizations are approaching sovereignty requirements, join Omdia’s Simon Robinson and VergeIO on November 19 for a live webinar on data sovereignty without the complexity or cost. Register here.

Frequently Asked Questions

What is the difference between data residency and data sovereignty?

Residency is about where data is stored. Sovereignty is about who controls it. Data stored in-country by a provider under another country’s jurisdiction is resident, but that provider can still be compelled to produce it.

Why is data sovereignty an infrastructure problem?

Sovereignty depends on every layer that touches the data, including compute, storage, networking, management software, licensing and the vendor connections each product makes. The more separate layers in the stack, the harder it is to run and prove.

Does on-premises infrastructure still need confidential computing?

Usually it does not. Confidential computing protects data from a hosting provider. In a facility the organization owns, encryption at rest and in flight to remote sites, with keys held in-house, covers most requirements on existing servers.

What is a disconnect drill?

IT cuts every outside connection and runs normal operations, including a patch cycle and a restore. Anything that breaks is a sovereignty dependency to fix or replace.

Why is sovereignty harder for midsize enterprises?

A midsize enterprise runs its data center with a three-to-five-person team and lacks the budget to duplicate infrastructure in each jurisdiction. Collapsing the stack into one infrastructure operating system gives that team fewer products to secure, patch and audit.