Cloud Sovereignty Framework

Key finding: Few nations immediately achieve full sovereignty across all workloads. Instead, they map each workload to the appropriate level — overlaying data-sensitivity classification on the sovereignty pyramid and a governance layer — so that public websites, hospital records, and defence AI sit at the level their sensitivity, cost, and strategic value demand.

Introduction: Why Sovereignty Matters in the Digital Century

The concept of sovereignty — traditionally defined as the supreme authority of a state over its territory, laws, and people — has always been tied to geography, borders, and governance. In the 21st century, however, sovereignty extends far beyond land and sea into the digital sphere. The rise of cloud computing, artificial intelligence (AI), and globalized data flows has made digital infrastructure just as critical to a nation's survival and prosperity as energy grids or military defence systems.

For modern nation-states, cloud sovereignty is no longer an optional ambition but a strategic imperative. The issue is not merely one of data storage but of who controls, monitors, and can access information. If sovereignty is the bedrock of political independence, then digital sovereignty is the bedrock of technological independence.

Yet sovereignty in this space is not monolithic. It exists on multiple levels (from data residency to full sovereign clouds), across layers of responsibility (infrastructure, law, operations, governance), and along dimensions of data sensitivity (from public websites to national defence AI training datasets). For policymakers, technologists, and national security planners, understanding how these axes interact is essential to building a coherent sovereignty strategy.

This paper defines sovereignty broadly, introduces a five-level pyramid of cloud sovereignty, and integrates a data-classification and governance lens. Together, these create a countrywide sovereignty blueprint that balances technological capability, risk management, and economic development.

1. Defining Sovereignty Beyond Borders

Sovereignty, in classical political theory, is the exclusive right of a state to govern itself free from external interference. In digital terms, sovereignty means:

• Jurisdictional sovereignty: All data and infrastructure fall under national law, with no competing extraterritorial claims.
• Technological sovereignty: Domestic capacity to build, operate, and control critical digital systems without reliance on foreign actors.
• Operational sovereignty: The ability to manage, monitor, and respond to incidents entirely within national borders and with nationally accountable personnel.
• Economic sovereignty: Ensuring that domestic cloud and AI ecosystems generate value, jobs, and intellectual property for the home economy.

These four definitions overlap. A nation may achieve jurisdictional sovereignty (e.g., data stored locally under domestic law) but still lack technological sovereignty if foreign companies control the underlying software. Conversely, a state may develop its own cloud technologies but lack operational sovereignty if key support functions are outsourced abroad.

Thus, sovereignty is best understood as a multi-layered continuum, not a binary.

2. The Five Levels of Cloud Sovereignty

To structure this continuum, we can use a five-level pyramid framework. Each level represents a deeper integration of sovereignty principles into cloud infrastructure.

Level 1 — Data Residency

• Data is stored domestically, but ownership and operational control may still reside with foreign companies.
• Suitable for low-sensitivity workloads such as public websites and basic administrative portals.
• Risks: Subject to foreign extraterritorial laws (e.g., U.S. CLOUD Act); limited protection against foreign surveillance.

Level 2 — Controlled Residency

• Both storage and processing occur within the country. Encryption keys may be managed domestically.
• Compliance certifications are aligned with local standards.
• Suitable for moderate-sensitivity workloads, such as payroll or procurement.
• Risks: Still exposed to foreign vendor ownership and possible remote administrative access.

Level 3 — Legal & Operational Sovereignty

• Provider is legally domiciled within the country and exclusively subject to national law.
• Local operations and staff manage the infrastructure; national regulators have audit rights and compliance oversight.
• Suitable for sensitive personal data (health records, citizen IDs).
• Crypto & PQC: Mandatory encryption of data-at-rest and in-transit using nationally approved algorithms; establish a national PQC readiness plan (crypto inventory, migration runbooks, and dual-stack operation for hybrid classical/PQ).
• Key Management: Keys generated, stored, and rotated within domestically governed HSMs or accredited KMS; split-trust (e.g., n-of-m) quorum for key escrow; no foreign-held key material; comprehensive key-lifecycle logging.
• Policies: Binding controls to prohibit remote privileged access from outside national jurisdiction; regulator visibility over admin actions and KMS logs; breach-notification SLAs tied to sovereignty impact.
• Data Fragmentation: For high-value datasets, implement logical fragmentation or secret sharing across multiple domestic availability zones/providers with policy-based reassembly controls.

Level 4 — Technological Sovereignty

• Domestic companies own and operate the cloud stack (infrastructure, middleware, orchestration); critical IP is licensed or co-owned.
• No remote root access from abroad; national standards ensure interoperability with allies.
• Suitable for critical workloads such as financial systems, transportation networks, or large-scale AI training.
• Crypto & PQC: Default to PQC-agile stacks (e.g., hybrid TLS with approved KEMs/signatures) for inter-DC links, control planes, and machine-to-machine auth; mandate crypto-agility (rapid algorithm rotation) via policy.
• Key Management: Establish a Sovereign Key Infrastructure (SKI) operated by a national trust authority; enforce domestic HSM residency, attestation of hardware provenance, and tamper-evident audit trails.
• Policies: National baselines for logging, retention, and lawful-access constraints; mandatory red-teaming of cryptographic controls and KMS misuse scenarios.
• Data Fragmentation: Adopt policy-governed fragmentation with placement constraints (fragments confined to national borders across independently controlled fault domains); use erasure coding or secret sharing aligned to recovery objectives; integrate fragment access with SKI (reassembly requires multi-party authorization).
• Risks: Costly to develop; requires substantial domestic R&D.

Level 5 — Full Sovereign Cloud

• 100% national ownership and control of infrastructure, operations, governance, and IP; exclusively domestic staff with security clearance.
• Full compliance with national cybersecurity certifications; redundancy and resilience engineered within national borders.
• Suitable for defence, intelligence, and strategic AI ecosystems.
• Crypto & PQC: End-to-end PQC-by-default — including data-in-use protections for sensitive analytics via TEEs or MPC where applicable; mandated PQC for backups, archives, and cross-domain transfers.
• Key Management: SKI extended to cross-agency federation with strict separation of duties; offline roots held under sealed domestic custody; threshold signatures and confidential computing attestation for high-privilege operations.
• Policies: Sovereign cryptographic policy codified in law (approved algorithms, certification schemes, lawful-intercept constraints, sanctions on non-compliance); continuous conformance monitoring.
• Data Fragmentation: National-scale fragmentation fabric coordinating government and critical-industry clouds; shard placement regulated by policy, with disaster recoverability proven by periodic drills.
• Risks: High cost, slower to scale, requires robust domestic talent and vendor ecosystem.

Summary Table: Level 1 — Level 5

Level	Key Criteria	Risks / Gaps
Level 1 — Data Residency	Data stored domestically (primary + backups); some workloads processed locally; baseline encryption per local standards; no domestic key-custody requirement.	Foreign ownership of provider; subject to foreign extraterritorial laws; admin/support outside country; remote privileged access possible from abroad.
Level 2 — Controlled Residency	Data stored & processed in-country; encryption keys preferably managed domestically (KMS/HSM in-country); local compliance certifications; network paths confined to domestic routes where feasible.	Foreign vendor may still own infra/software; possible remote admin from abroad; partial exposure to CLOUD Act equivalents; risk of key escrow/backup outside jurisdiction if not enforced by policy.
Level 3 — Legal & Operational Sovereignty	Provider legally domiciled in-country, exclusively subject to national law; operations & admin staffed locally with regulator audit rights; mandatory encryption in-transit/at-rest with nationally approved algorithms; PQC readiness (crypto inventory, migration runbooks, hybrid pilots); keys generated/stored/rotated in accredited domestic HSM/KMS with split-trust (n-of-m) for escrow; immutable audit logs for key events & admin actions; data fragmentation for high-value datasets (logical sharding/secret sharing within borders).	Core software/IP may remain foreign-owned; dependency on foreign patches/updates; PQ migration risk/complexity if inventory incomplete; collusion/misuse risk without strong split-duties; early operational maturity of fragmentation patterns.
Level 4 — Technological Sovereignty	Domestic company operates cloud stack (infra, middleware, orchestration) with critical IP licensed/co-owned; no remote "root access" from abroad with hardware/firmware attestation; PQC-agile by default (e.g., hybrid TLS with approved PQ KEMs/signatures); Sovereign Key Infrastructure (SKI) with domestic HSM residency & tamper-evident logs; policy-driven fragmentation (shard placement within borders across independent fault domains; reassembly quorum tied to SKI); red-teaming of crypto/KMS misuse with regulator-grade logging & retention; confidential computing/TEE for selected sensitive workloads.	Higher cost of R&D/operations; added complexity can impact performance vs. hyperscalers; supply-chain constraints for certified domestic HSM/TEE; ecosystem/talent capacity must scale to operate SKI and fragmentation fabric.
Level 5 — Full Sovereign Cloud	100% national ownership/control (infra, IP, operations, governance) with cleared domestic staff; full compliance with national certifications and resilience engineered within borders; PQC by default end-to-end (incl. backups/archives & cross-domain transfers); SKI federation across agencies with offline roots in sealed custody and threshold signatures for high-privilege ops; national-scale fragmentation fabric coordinating gov/critical-industry clouds with periodic DR drills proving reconstitution; data-in-use protections (TEEs/MPC) for strategic analytics; continuous conformance monitoring codified in law/policy.	Costly and slower to scale; risk of over-specification; requires strong domestic vendor/talent ecosystem; rigid standards may reduce interoperability/innovation if not reviewed; coordinating national fragmentation fabric adds operational risk if governance is weak; PQ algorithm shifts could require rapid re-keying at scale.

Key Insight: Few nations immediately achieve Level 5 across all workloads. Instead, they map workloads to the appropriate level based on sensitivity, cost, and strategic value.

3. The Data Dimension: What Requires Sovereignty?

The level of sovereignty required depends on what type of data is being processed. Not all data is equal, and classifying data is critical to a sovereignty strategy.

• General Public Content — Websites, marketing portals, open data sets. Low sovereignty requirements.
• Administrative & Business Data — Tax filings, payroll, procurement. Medium sovereignty requirements (Levels 2–3).
• Sensitive Personal Information — Health, education, financial records, biometric IDs. High sovereignty requirements (Levels 3–4).
• National Security & Critical Infrastructure Data — Defence communications, grid control, emergency response. Very high sovereignty requirements (Levels 4–5).
• AI Models & Training Data — Foundational models trained on sensitive datasets. Very high sovereignty requirements (Level 5).
• Archival & Historical Data — Citizen registries, court decisions, legal archives. Moderate to high sovereignty requirements, depending on legal mandates.

Key Insight: A countrywide sovereignty blueprint requires overlaying data sensitivity classification on top of the sovereignty pyramid.

4. Governance and Oversight: The Hidden Layer

Even the most advanced sovereign cloud is only as trustworthy as its governance system. Governance ensures compliance, transparency, and accountability. It includes:

Policy Governance

• Defining clear thresholds for what data must be sovereign.
• Establishing legal frameworks that exclude foreign jurisdictional claims.
• Creating sovereign cloud authorities to license and monitor providers.

Operational Governance

• Mandatory compliance audits by national regulators.
• Continuous monitoring of data flows and administrative actions.
• Transparency reports provided to government stakeholders.

AI-Enabled Governance

• Real-time anomaly detection: AI engines monitor for unauthorized data access or exfiltration.
• Automated compliance auditing: AI validates logs, encryption key usage, and access control continuously.
• Predictive risk analysis: Identifying sovereignty breaches before they occur.
• Explainability frameworks: Ensuring that AI systems governing sensitive workloads remain accountable.

Cryptographic & Data-Fragmentation Governance

• National Cryptography Policy: Codify approved classical and PQ algorithms, key sizes, and deprecation timelines; require crypto-agility and inventory of cryptographic assets across agencies and critical industries.
• Sovereign Key Infrastructure (SKI): Establish a national trust authority and accreditation regime for KMS/HSM providers; mandate domestic key residency, split-trust, and tamper-evident audit logs.
• Fragmentation Policy: Define placement constraints (national borders, independent operators), minimum shard dispersion, reassembly quorum, and continuous recoverability testing.
• Assurance & Certification: Create certification tiers for cryptographic modules, TEEs, and fragmentation controllers; require periodic penetration tests and red-team exercises focused on key-theft and shard-correlation risks.
• Incident Response: Standardize playbooks for key compromise, algorithm deprecation events (e.g., PQ vulnerabilities), and shard integrity failures; require regulator notification SLAs.

Key Insight: Governance is not static; it evolves. Nations that embed AI-based compliance gain dynamic sovereignty, adjusting in real-time to emerging risks.

5. A Multi-Axis Blueprint for Sovereignty

The interaction of levels, data types, and governance produces a multi-dimensional model:

• Vertical axis: Levels of sovereignty (1–5).
• Horizontal axis: Data classification (public → national security).
• Overlay: Governance maturity (manual → AI-driven real-time).

This three-layer cube allows policymakers to map every workload to its appropriate sovereignty requirement.

Example Applications:

• A national tourism website → Level 1 + Public Data + Minimal Oversight.
• A hospital records system → Level 3 + Sensitive Data + Continuous Auditing.
• A defence AI simulation → Level 5 + National Security Data + Real-time AI Governance.

6. Countrywide Landscape: Coexistence of Levels

No country implements a single sovereignty standard across all domains. Instead, a layered ecosystem emerges:

• Public and commercial sectors often operate at Levels 1–2, focusing on efficiency and cost.
• Government administration moves into Levels 2–3, with stronger compliance.
• Critical sectors such as finance, energy, and healthcare require Levels 3–4.
• Defence and intelligence demand Level 5.

This coexistence must be managed through national policy frameworks, ensuring that workloads are allocated according to sensitivity and that interoperability between levels does not create sovereignty leaks.

7. Challenges and Trade-Offs

Economic Trade-Offs

• Full sovereignty (Level 5) is costly; not all workloads justify it.
• Nations must balance sovereignty with innovation speed and cost efficiency.

Technological Capacity

• Domestic capability to build sovereign infrastructure varies. Smaller nations may need to pool resources regionally.

Geopolitical Considerations

• Sovereignty often collides with alliance interoperability. NATO, EU, and Five Eyes members must harmonize standards without compromising domestic control.

Talent Shortages

• Sovereign operations require domestic staff with high-level clearances. Developing this workforce is a long-term investment.

8. Towards a Sovereignty Roadmap

An actionable sovereignty roadmap for governments should include:

1. Data Classification Framework — Clear categories that define what must be sovereign.
2. Sovereignty Level Assignment — Mapping workloads to Levels 1–5 based on sensitivity.
3. Governance Infrastructure — Independent regulatory authorities empowered to audit continuously.
4. Ecosystem Development — Support for domestic SMEs, cloud vendors, and AI developers to participate in sovereign solutions.
5. Investment Strategy — Targeted public funding and incentives for domestic sovereign infrastructure.
6. International Positioning — Coordinated stance in alliances and trade agreements to defend sovereignty principles.

Roadmap additions to include advanced sovereignty features — cryptography, PQC, and fragmentation:

7. PQC Transition Program: Inventory cryptographic assets; adopt hybrid PQC for transport and at-rest encryption; define deprecation timelines for vulnerable algorithms; fund migration toolchains.
8. Sovereign Key Infrastructure (SKI): Build a national trust authority; accredit domestic KMS/HSM providers; standardize split-trust, threshold cryptography, and attestation requirements.
9. National Fragmentation Fabric: Develop policies and controllers that enforce shard placement within borders, independent operator dispersion, and reassembly quorum; integrate with SKI for authorization.
10. Data-in-Use Protections: Expand beyond at-rest/in-transit encryption to confidential computing, secure enclaves, and MPC for selected workloads.
11. Assurance & Drills: Mandate periodic recovery and reconstitution exercises proving that fragmented datasets can be restored under disaster scenarios without breaking sovereignty constraints.

Conclusion: Sovereignty as a Strategic Asset

Sovereignty in cloud and AI is not a static achievement but a dynamic equilibrium. It requires constant balancing of cost, capability, risk, and opportunity. By integrating the five levels of sovereignty, the classification of data, and the layer of governance, a nation can build a comprehensive sovereignty blueprint that both protects its citizens and fosters innovation.

Ultimately, sovereignty is about control and accountability. Just as borders define a state's control over its land, sovereignty frameworks define its control over its data and digital future. The states that master this balance will not only secure their independence but also leverage sovereignty as a strategic asset for economic growth and geopolitical influence.

Key Takeaways

• Level 1–2: Focuses on where data sits but still exposes the country to foreign control.
• Level 3–4: Adds legal insulation and operational independence — often referred to as "trusted" or "sovereign cloud."
• Level 5: Represents absolute sovereignty — complete domestic control over law, infrastructure, operations, and ecosystem development.