Ask how far an enterprise should go to keep its data sovereign, and it often resolves to picking a side – hold everything inside a trusted region, or keep drawing on the speed and scale of the global cloud.
Patrick Smith, chief technology officer of Everpure, argues the more useful answer lies somewhere in-between.
Smith is the latest senior storage figure to answer questions on data sovereignty. He works through the same questions posed to the earlier contributors in this series, individually and at length.
In this article we set out his answers, which cohere around a single argument for selective sovereignty: precise, workload-by-workload choices that apply strong controls where risk runs highest, while continuing to use global platforms where they add the most.
It is a case for balance rather than lockdown – and it adds another voice to the debate running through this series on data sovereignty.
The assumption trap
Smith begins where the series began, with the assumptions enterprises still carry. “The most outdated assumptions are that data sovereignty is primarily a question of keeping information inside a national border, satisfying a cyber security requirement or ensuring compliance with regulation,” he says. “That view is too narrow for today’s world.”
Across the next 12 to 18 months, he argues, the real test is whether an organisation holds visibility, governance and control over the whole data lifecycle. That means, “understanding where data is stored and processed, who can access it, which jurisdictions and regulations apply, and whether the organisation can continue operating if a provider or service becomes unavailable”.
Location, in other words, still matters, but it doesn’t settle everything. “An organisation can store data locally and still have limited or ineffective sovereignty if it does not understand who operates the platform, who controls access, which legal jurisdictions apply, or how data can be managed and recovered,” says Smith.
A question of balance
On whether the world is fragmenting into distinct data blocs, Smith is measured. “We may see more regional influence over how sensitive data is stored, processed and transferred, but that does not necessarily mean a world of closed data blocs,” he says.
Cross-border flows and global cloud, hyperscaler and software as a service (SaaS) offerings, he argues, will remain crucial where they meet business and regulatory requirements.
That leads to the line that defines his argument. “Data residency does not equal data sovereignty, and at the same time an all-or-nothing approach to sovereignty would mean losing access to valuable global platforms,” he says. “A balance is definitely required.”
The AI inheritance
The balance test sharpens when artificial intelligence (AI) enters the frame. Smith’s answer to whether sovereignty extends to models, outputs and derived data is blunt: “It’s safest to assume that sovereignty considerations extend beyond the original dataset.”
The outputs of AI models may contain sensitive information or reveal strategic intent.
The practical risk, he argues, sits in inference rather than training. “Organisations need to understand whether models are deployed locally or accessed as global services, and whether sensitive prompts and context are leaving the sovereign environment.”
For organisations that lean on retrieval-augmented generation, that means validating what an inference workload can actually reach.
Policy, not parallel stacks
Smith’s architectural answer to operating across jurisdictions is a unified one. He points to Everpure’s Enterprise Data Cloud vision – which brings data together across on-premise, public cloud and hybrid environments “through a unified data plane and managed by an intelligent control plane” – combined with governance software that can “discover, classify and contextualise data wherever it resides”.
The aim is to govern by policy rather than build a separate stack for every regime. “This approach can help with sovereignty as it enables the use of policy to govern data placement, access, protection, replication and recovery across locations and workloads, rather than creating a separate technology stack for every jurisdiction,” he explains.
The result, says Smith, is “a cloud-like operating model” that applies stronger controls to the most sensitive workloads while still drawing on public cloud where it adds most.
Control, in this reading, means visibility and authority: the power to “decide where data is held, who can access it, how it is used, where it can move, how it is protected, and how it can be recovered or removed”.
Most models fall short, he says, when organisations cannot see “the location of all data and potential copies, the jurisdiction of the operator, privileged access, metadata handling, portability or recovery options”.
The value of precision
The commercial pay-off, argues Smith, does not come from maximum restriction. “Competitive advantage won’t come from adopting the most restrictive environment,” he says. “It will come from making precise choices – keeping critical and sensitive assets within appropriate levels of control whilst leveraging global providers where they can add speed, scale, functionality and innovation.”
Done well, says Smith, a sovereignty strategy supports customer trust, participation in regulated markets, protection of proprietary information and confidence in AI adoption.
Looking ahead, he expects a selective rather than a maximalist end state. “We’ll start to see sensitive and high-risk data staying in-region by default, and AI systems will need to be transparent about data origin and handling requirements,” says Smith.
The sovereignty service-level agreement, by contrast, “could emerge more gradually over time as the industry fine-tunes procurement and contractual commitments covering location, access, operator accountability, portability, incident response and recovery”.
For Smith, the trajectory is clear. Sovereignty is not a wall; it is a dial – and the enterprises that win will be the ones that learn to turn it precisely.
