Data residency is where your data physically sits; data sovereignty is who controls it and who can be legally compelled to disclose it. They sound interchangeable in vendor brochures, but they are different guarantees — and for enterprise AI, mistaking one for the other can leave you exposed exactly where you thought you were covered.
Two different questions
| Data residency | Data sovereignty | |
|---|---|---|
| Asks | Where does the data sit? | Who controls it, and who can be compelled? |
| A claim | ”Hosted in Frankfurt" | "Your tenant, your jurisdiction” |
| US-owned EU region | Satisfies it | Fails it (CLOUD Act) |
| Protects | Location | Control + jurisdiction |
Residency is a statement about bytes at rest, not about control. A provider can store your data in an EU data centre and still be obliged, under its home jurisdiction, to hand it over. Sovereignty asks who holds the keys, who operates the runtime, and who can be served a legal demand.
Why the distinction decides your AI stack
Retrieval-augmented generation concentrates your most sensitive knowledge — internal documents, customer records, contracts — into one searchable system. A residency-only solution satisfies “where” but still onboards a new sub-processor and carries transfer risk. A sovereignty-first solution — self-hosted, model-agnostic, no phone-home — satisfies both “where” and “who”: with local models via Ollama, nothing leaves the network at all.
How to test a vendor
Three questions residency claims can't answer
- Who can be legally compelled to disclose our data, and under which jurisdiction?
- Can the system run with no outbound connections — air-gapped — and still function?
- Can we export everything and leave without re-platforming?
If the honest answers are “a foreign provider,” “no,” and “not really,” you have residency, not sovereignty. For the fuller framework, see What is sovereign enterprise AI? and the sovereignty page.
Frequently asked questions
Is residency still important?
Yes — it is often a contractual or regulatory requirement, and for some workloads (KRITIS in Germany) processing location is non-negotiable. The point is that residency is necessary but not sufficient: it does not, by itself, answer who controls the data.
How do I test a vendor's real position?
Ask who can be legally compelled to disclose your data and under which jurisdiction; whether the system can run air-gapped and still function; and whether you can export everything and leave. Residency claims cannot answer those.
Sources & further reading
- US CLOUD Act — overview (US Department of Justice) — extraterritorial access regardless of storage location
- GDPR / DSGVO — international transfers (Chapter V) — why transfers and control matter
- What is sovereign enterprise AI? — the fuller framework