Data sovereignity requires a new look at clouds

Where is your data?

This question isn’t just a thought experiment anymore. Organizations want to use the cloud for its operational benefits, but a cloud is (as the old joke goes) simply other peoples’ computers. This brings up the pertinent question of where your data is located and who can access it when you use a public cloud.

Over 60 countries currently have rules on the geographical location of data. Europe is the world leader in this policy revolution, and the Nordics are the leaders of Europe. Companies need to comply with the laws and ensure data security. Your data is valuable – not just to you, but to criminals, competitors and even other countries or state-sponsored actors. This is where data sovereignty comes in.

The fear is that if you use a public cloud you could lose data sovereignty, or the power to control use of that data. If data is under the jurisdiction of another country it may not have the same protections as the country where it was gathered. One way to solve this challenge is to avoid the cloud altogether, but then you miss out on all the benefits. Another option is a sovereign cloud.

A sovereign cloud is a cloud which ensures all data and related metadata stays on sovereign soil. There is no single, legal definition of a sovereign cloud but the concept is simple.

A sovereign cloud is not unique technology; what is unique about it is how and where it is applied. It is cloud technology following an accepted framework to maintain compliance and ensure proper control and access of data. Data and metadata are resident within the relevant jurisdiction, it remains subject to the laws of the country where it was collected, and other nations can’t access it.

Some industries have received special attention from legislators, such as finance, health and the public sector. In many jurisdictions they are required to maintain local infrastructure to ensure data sovereignty and the required controls. Yet this issue is impacting more organizations than heavily regulated ones. Nearly every company operating in Europe has privacy rules to follow thanks to GDPR, and some other jurisdictions around the world either have or are considering similar regulations.

For example, imagine a Norwegian green energy startup who has developed software to manage energy grids. They deal with critical national data but want the modern development benefits of a cloud, and so they might be a good candidate for a sovereign cloud. Another example could be a Swedish university that has a new program for academic researchers and businesses to work together. They have personal data to consider, as well as proprietary information of considerable business value. Again, a sovereign cloud could fit their needs.

We have created a self-serve sovereign cloud which retains all the benefits of a cloud, such as flexibility, scalability and access to modern tools like containers and Kubernetes. A subscription model makes expenses more transparent and easier to calculate. The pay-as-you-go system makes it easy to control and minimize costs.

A sovereign cloud has its specific uses, so it is often the case that one is used in a hybrid or multi-cloud solution. You use the right tool for the task at hand, so many organizations have multiple clouds in their toolbox. If you want to see how we can help you enjoy the benefits of the cloud while retaining data sovereignty, please get in touch with our experts.