The phrase “sovereign cloud” has become one of the most overused and least scrutinized terms in enterprise technology. It sounds reassuring, especially to governments, regulated industries, and any enterprise concerned about geopolitical instability. The promise is simple enough: keep data local, maintain operational control, and reduce dependence on foreign systems. The problem is that the reality of cloud architecture does not align with the marketing.
A cloud is not sovereign simply because the data center sits within a national border. Sovereignty is not a matter of street address. It is a matter of who owns the platform, controls the codebase, operates the control plane, supplies the chips, patches the software, and which legal system can ultimately compel access or impose disruption. If you cannot answer those questions with confidence, you do not have a sovereign cloud. You have a local hosting arrangement with a comforting label.
Enterprises are being sold a version of cloud that is allegedly independent, but the deeper you look, the more you find layers of dependency that never went away. Some are technical. Some are contractual. Some are geopolitical. All of them matter.
The full-stack problem
