Sovereign Customer Data Platforms: Residency vs Sovereignty vs Jurisdiction

Data residency is where data is stored; data sovereignty is whose laws and authorities can reach it; data localisation is a legal duty to keep it in-country. Residency alone is not sovereignty: a provider subject to a law such as the US CLOUD Act can be compelled to disclose data wherever it sits. A sovereign customer data platform (CDP) therefore needs controlled keys, support access, sub-processors, updates, telemetry and model inference, not just an EU region.

Who this is for: CISOs, DPOs, architects and martech owners who see "EU hosting" in a proposal and need to know what it does and does not prove. Part of the guides hub.

Residency, localisation, sovereignty and jurisdiction

Three short examples:

• Residency without sovereignty. An EU-region SaaS run by a non-EU parent, with support engineers abroad who can view data.
• Localisation without sovereignty. A mandatory in-country data centre run by a foreign operator.
• Sovereignty with residency elsewhere. A multinational's customer-operated deployment in another country under its own keys: control is yours, the location is not the EU.

Why residency alone fails

The Commission makes the point itself in the Cloud and AI Development Act (CADA) proposal: data localisation only partly solved sovereignty needs, and the EU-US Data Privacy Framework addresses transfers without removing concerns about dependence on third-country providers 3. Five gaps recur.

1. Jurisdiction: the CLOUD Act and GDPR

The CLOUD Act (18 U.S.C. 2713) obliges covered US providers to preserve and disclose data in their possession, custody or control whether it is located inside or outside the United States 4. GDPR Article 48 says a third-country court or authority order to transfer or disclose personal data may be recognised or enforced only if based on an international agreement such as a mutual legal assistance treaty 6. The Data Act adds, for non-personal data, that providers must take adequate measures against unlawful foreign governmental access and that foreign orders are enforceable only if based on an international agreement or, failing that, on narrow conditions including court review (Art. 32) 7. A provider caught between the two regimes cannot satisfy both; as the customer, you carry the risk.

Two clarifications keep this honest. First, while the EU-US Data Privacy Framework remains valid, transfers to certified US recipients are lawful; it survived its first court challenge and sits on appeal (see GDPR transfers after Latombe). Second, the European Data Protection Board's transfer recommendations are explicit about technology: strong encryption with keys retained solely by the exporter, or by a trusted entity in the EEA or an equivalently protective jurisdiction, can be an effective supplementary measure (use case 1), but when a cloud processor needs data in the clear in a third country with problematic access laws the Board could not envisage an effective technical measure, and encryption is not enough if the importer holds the keys (use case 6) 8. That is why key custody comes first in the checklist below.

2. Support and operations access

The most common leak is a person. "Follow-the-sun" support, break-glass access and managed upgrades are remote access. Microsoft's own EU Data Boundary documentation says its commitments are subject to limited circumstances in which data continue to be transferred outside the boundary 9. CADA's level 1 requires traceability and governance where support is outsourced outside the Union, and level 2 requires support to be initiated and performed in the Union 3.

3. Sub-processors

GDPR Article 28 bars engaging another processor without written authorisation and flows obligations down the chain 10. A sub-processor list that is not tied to geography, role and data type tells you little. CADA level 1 asks for full transparency on subcontractors, and DORA Article 30 requires advance notice before service or data locations change for financial entities 311.

4. Telemetry, logs and metadata

Residency pledges often cover "customer data" but not logs. CADA level 1 explicitly includes metadata and telemetry 3. Microsoft's documentation describes pseudonymised system-generated logs as a separate category 9. Ask what is collected, where it goes and whether it can be switched off.

5. Updates and the AI layer

A vendor-run update channel is a standing path into your environment, and a call to an external model API sends customer data out. CADA levels 2 to 4 require a software bill of materials and controls against remote features that could tamper with or disrupt the service, and forbid using service data to train third-country AI systems 3. For model inference, see AI agents on customer data inside your boundary. In a vendor-commissioned survey, 52% of respondents said AI training data had to stay on-premises for security or compliance 12.

A maturity ladder for customer data

The ladder is cumulative: each rung keeps what the one below gave you. Higher rungs cost more to operate; the guide to self-hosted and private-cloud platforms covers running costs, and cloud repatriation covers when moving up makes economic sense. As a rough mapping, rung 1 aligns with CADA level 1 at best, rung 2 with levels 1 to 2, and rungs 3 and 4 can approach levels 2 to 4 only if the underlying infrastructure and software chain also qualify. This is indicative, not an assessment; see the EU cloud sovereignty framework.

What a sovereign customer data platform should mean: a buyer checklist

Add two more: the vendor's legal entity and ownership, and exit terms (see vendor lock-in clauses and the cloud exit strategy template).

Test, do not trust: a five-step diligence

1. Ask for the legal entity chain up to the ultimate owner, and the laws that apply to each entity.
2. Request the key architecture document and confirm in a test environment that the vendor cannot decrypt without your action.
3. Review a real support session procedure: who approves, from where, with what logging.
4. Run an egress test: capture outbound traffic from a proof-of-concept deployment for a week and reconcile it with the vendor's telemetry statement.
5. Rehearse an update and a rollback using only artefacts you hold, then repeat with the network cut.

Vendor landscape mapped to the ladder

The mapping is our reading of public pages checked in October 2026, not vendor-confirmed. Verify every claim in your own diligence.

| Tealium Private Cloud | 1 to 2 | Dedicated environment, single- or multi-tenant, regionally designated; Tealium appears to operate it and signs business associate agreements 16 | Operator, key custody, regions | | Meiro | 3 to 4 | Self-hosted on-premise, bring-your-own-cloud or hybrid, or managed; claims "zero data egress" without substantiation; no explicit EU claims on the page 17 | Keys, support, updates, telemetry |

| Warehouse-native activation (Hightouch, Fivetran Activations, Zeotap) | Inherits the warehouse's rung | The activation layer is SaaS | What leaves the warehouse and where it goes | | PrivyCDP | 3 to 4 | Customer-operated on-premise, VPC in AWS, Azure, GCP or OCI, hybrid, and sovereign or air-gapped; single-tenant with no shared control plane or telemetry egress during canary; signed artefacts with no forced auto-update; inference inside the customer boundary 1819 | Key custody and vendor support access are not detailed on the deployment and security pages; ask | | Open-source projects (for example Apache Unomi) | 3 to 4 | You operate them and add identity, consent and audit layers | See open-source customer data platforms compared |

When SaaS is the right answer

Sovereignty has a cost. For low-sensitivity data, small teams, no regulatory driver and no operations capacity, an EU-region SaaS with a sound data processing agreement is a reasonable choice, and rung 3 or 4 would add work without reducing real risk. Move up when a rule, a customer or a threat model demands it. Public-sector scenarios are covered in citizen engagement data without foreign cloud; country rules are in data residency requirements by country.

---