Sovereignty is not just about where your data is

Ask most organisations what Sovereign Cloud means and the first answer is almost always the same: keeping data in Australia. It is a sensible assumption, but it isn’t the whole answer. A data centre can sit on Australian soil while the people who run it, the technology that controls it and the laws that govern it may all be located somewhere else.

“When people think about data, they think about their own data, and they don’t necessarily think about anything else,” said Oliver Beck, CTO & Head of Sovereign Cloud Technology & Delivery at SAP Sovereign Cloud. “They also need to ask: Who are the people who actually operate the system? What kind of telemetry data flows out of the country? Who has connectivity from outside the country into this environment?”

This an important issue, not only for high-security government agencies, but for any organisation handling sensitive data, such as healthcare organisations, financial institutions, telecommunications companies and critical infrastructure providers, such as energy, water and transport system providers.

The residency trap

Treating residency as the whole story is appealing because it is simple: you can point to a location on a map and tick a box. But the same simplicity hides what actually determines control: who can access the environment, how it is built and which jurisdiction can compel disclosure of what it holds.

The pressure to get this right is growing. The Productivity Commission estimates that broader AI adoption could lift labour productivity by up to 4.3% over the next decade, worth around $116 billion in GDP. Capturing that depends on a foundation organisations can trust and rely upon to work in the future, regardless of cybersecurity risks and geopolitical change.

Dimension one: data sovereignty

Data sovereignty, in its broadest terms, means data is governed, processed and protected under the laws and policies of the country where it originates. This includes classifying data, ensuring it is processed lawfully, controlling who can access it and automatically restricting cross-border transfers, across both primary and secondary data flows such as backups and logs.

“With SAP Sovereign Cloud we bring everything that we need into the country: we replicate all of our sources into the country permanently so that even in the worst case, such as undersea cables being cut, we would be able to continue to operate,” said Beck. “If you need constant connectivity back to the provider outside the country then you are already creating an additional door to a potential attacker, or putting the control of access to your data in the hands of those who have other agendas.”

Dimension two: operational sovereignty

Operational sovereignty is about establishing who can administer, operate and access an environment, and under what conditions. Incident response, maintenance and escalation paths need to stay within trusted jurisdictions, and sensitive operations must remain local. In a government environment, only authorised personnel that are local nationals with the required security clearances should handle administration and maintenance.

This is where a simple local data centre can fall short. If the staff with privileged access, or the support processes behind them, sit outside trusted jurisdictions, location alone provides little assurance.

“In Australia, SAP Sovereign Cloud employs only Australian nationals in our facilities, both sites having facility security clearances,” explained Beck. “With those nationals that are operating under a contract with SAP Australia, we make them undergo security clearances appropriate to any government customers they will be serving.

“In addition to these measures, we also address risks via numerous technical measures that are all targeted to reduce potential attack vectors to a minimum.”

Dimension three: technical sovereignty

Technical sovereignty concerns the architecture and the local controls that manage a platform. It requires robust tenant isolation, so that customers’ data and workloads are separated from others. It also requires strong encryption, governed control-plane operations (the management and orchestration layer of a cloud environment) and independent auditability.

“What we are providing is a fully-fledged standalone environment each with their own specific security measures,” said Beck. “Then we have a whole self-developed control plane that basically allows us to also differentiate each and every tenant in each and every system, and who is allowed to have access and who is not.”

Dimension four: legal sovereignty

Legal sovereignty ensures that digital operations remain subject to local laws, courts and regulators in approved countries. It involves jurisdictional clarity, transparent ownership structures, contractual safeguards and removal of foreign access obligations. It also provides the enforceability that the other three dimensions depend on. Without it, controls can exist on paper but be overridden by a legal demand from elsewhere.

“In Australia, SAP Sovereign Cloud operates solely on Australian premises with Australian staff, and has no storage or connectivity outside of Australia, so there is no legal or physical way for anyone outside of Australia to request information from the system,” said Beck. “Even if there is the rare case that we need support advice from our global office, we will never have the global office or anyone outside Australia, accessing the environment.

“In the case of software updates, the Australian teams pull the update and are in control of the deployment. Nobody will ever be able to access the environment or even see anything in the environment from outside Australia.”

Why the four dimensions work together

The dimensions are interdependent. Data controls without operational controls can be bypassed by a privileged administrator. Operational controls without technical safeguards depend on trust rather than evidence. And technical safeguards without legal certainty can be overridden by an external legal demand.

Not every workload needs the same level of sovereignty. National security, defence and citizen services data call for the strongest controls, while other workloads may be well served by other cloud models. The skill is in matching the level of sovereignty to the sensitivity of the data.

How SAP puts this into practice — in the cloud and on-site

Australia was one of the first markets where SAP launched Sovereign Cloud capabilities in 2023. In most cases, SAP Sovereign Cloud can be hosted at SAP Australia or in a local accredited data centre, but for those organisations that wish to have full control over hardware and location, SAP is now offering SAP Sovereign Cloud On-Site, which lets customers host SAP’s managed cloud infrastructure, built on open-source technology, within their own facilities. For government agencies and critical infrastructure operators, it offers the highest level of physical control without giving up the benefits of managed cloud services.

“You could say that Sovereign Cloud On-Site is the ultimate version because it can be operated in a full air-gap mode. In that case, the environment would have no connectivity outside a given network,” said Beck. “So for defence and intelligence customers, this means deploying everything on-site. In addition to the entire technology infrastructure — the systems, the servers, the racks — our staff are also deployed on the site, working directly alongside the customer to meet the most stringent security and operational requirements.

Sovereignty as the foundation for AI

Sovereignty cannot be retrofitted to an AI strategy after the fact. The more trusted and well-governed the data available to AI, the greater the opportunity to improve policy, service delivery and operational outcomes. Organisations that build strong foundations across all four dimensions now will be best placed to deploy and scale AI with confidence, accountability and public trust.

The next time someone says their data is sovereign because it is stored in Australia, the right response is a follow-up: and what about everything else?

To find out more, read the SAP white paper Is your cloud infrastructure ready for AI?

Image credit: iStock.com/BlackJack3D