Data sovereignty is no longer a procurement clause — it is an operational requirement: prove, with evidence, that your data lives where the regulator says it must, at every layer and not only in production.
Ænix runs a structured engagement that produces a control-level map of where your data actually lives today, where the gaps are, and what sovereignty-by-design looks like for your stack.
Pairs with: Ænix Private Cloud Platform for regulated enterprises consuming sovereign cloud internally, or Public Cloud Platform for operators offering it as a product — your hardware, your jurisdiction, opt-in volume encryption, air-gapped installation optional.
Who has a data sovereignty problem
Data sovereignty pressure shows up in different language depending on the buyer’s seat, but the underlying constraint is the same.
- Banks and insurers under DORA / sectoral supervision facing concentration-risk and data-residency obligations.
- Public-sector and quasi-public organizations subject to procurement-mandated sovereign-cloud requirements (EU member states, Kazakhstan, several APAC jurisdictions).
- Healthcare and life-sciences operators with patient-data residency rules under national health-data frameworks.
- Telecom and critical-infrastructure operators under NIS2 with sectoral data-handling rules.
- Multinational enterprises with data-localization requirements that vary by country (India, China, Russia, Brazil, several EU member states).
- AI / analytics teams working on sensitive data classes that cannot be processed by non-EU model providers.
If you can name a specific regulator, sectoral rule, or procurement clause that triggered this for your team — this engagement is built for that situation.
Reading as a CISO? The CISO guide summarises what the platform does and does not provide, and the GDPR evidence page documents encryption and key handling as they ship. AENIX s.r.o. holds ISO/IEC 27001:2022 certification for its own ISMS.
What “data sovereignty” actually requires of your architecture
1. Demonstrable data-residency at every layer Production storage is the easy part. Backups, observability data, CI/CD artifacts, and managed-service telemetry frequently leave the regulator’s perimeter without anyone noticing. Sovereignty applies to all layers, not just the production database.
2. Encryption and key custody under your control Encryption alone is not sovereignty. The data owner must be able to explain who holds the keys — ideally itself, not the cloud provider — with a documented rotation, emergency-access and audit process.
3. Supplier transparency to the second hop Hyperscalers run on data centres and connectivity providers; SaaS providers run on hyperscalers; managed services depend on shared infrastructure. Sovereignty requires knowing the chain past the first hop.
4. Audit and supervisory access Audit trails must be exportable in regulator-consumable formats, retained per the regulator’s requirement, and tamper-evident. Supervisor access processes must be documented and tested.
For practical detail with control-level checks, see data residency requirements 2026.
Where most cloud setups fail the sovereignty test
Observability and telemetry leak the perimeter Production database is in the right region. The SaaS observability stack collecting logs from it processes them through US-based regions because that’s where the vendor’s infrastructure runs. The compliance officer doesn’t know.
Backups are sovereign — until they’re tested Backup storage tier is in the right region. The DR test pulls backups across regions to a different DR site that turns out to be in a non-compliant jurisdiction. Sovereignty fails under stress.
Encryption keys are with the cloud provider Default encryption looks compliant on paper. Until the regulator asks who controls the keys — and the answer is the same vendor that holds the data.
Supplier chain is a black box past hop 1 The hyperscaler is named in the contract. The hyperscaler’s data-centre operator, networking sub-contractors, and shared platform services are not. DORA Article 30(2)(a) requires the subcontracting chain to be described in the contract; NIS2 Article 21(2)(d) requires supply-chain security to cover direct suppliers and service providers.
How Ænix helps
The data-sovereignty engagement runs as part of our Platform Readiness Assessment, with the sovereignty-and-regulator-gap workstream as primary focus. The 14- or 28-day engagement produces:
- Data-residency map — where each data class actually lives today, including production, backup, observability, and CI/CD artifacts. Per-class jurisdiction with evidence.
- Encryption and key-custody review — current encryption posture, key-custody arrangements, gap identification per data class.
- Supplier-chain map to second hop — every ICT third-party arrangement traced to its underlying providers and shared dependencies.
- Audit-readiness assessment — what supervisor access processes are documented, what tested, what missing.
- Architecture-level remediation plan — what to fix, in what sequence, with effort estimates and regulatory deadline alignment.
Delivered by Ænix engineers — the team that created Cozystack — from engineering teams in the EU and Central Asia, with no hyperscaler commercial alignment. EU contracts are with AENIX s.r.o. (Czech Republic).
Why Ænix specifically
- Engineers who work under these rules. Our engineering teams are in the EU and Central Asia; EU contracts are with AENIX s.r.o. (Czech Republic). We understand the difference between sovereignty as a US marketing term and sovereignty as it is enforced under EU sectoral rules and EU member-state procurement clauses.
- No hyperscaler bias. Sovereignty consulting from Big-4 firms is shaped by their hyperscaler partnerships. Our recommendations are not commercially tied to any cloud provider — we recommend the architecture that actually meets the sovereignty requirement, even when that means full on-prem.
- Open-source platform foundation. We created Cozystack and co-maintain it — a CNCF Sandbox project running on your chosen hardware in your chosen jurisdiction, with cluster-level access held by you. Sovereignty is structural, not contractual.
What the engagement looks like
Day 0 is a free 30-minute discovery call that fixes the scope. Days 1-13 (or 1-27) run four parallel workstreams with the sovereignty-and-regulator-gap workstream emphasized, on daily async updates and three sponsor checkpoints. Day 14 (or 28) is a 60-90 minute executive readout against the written report — data-residency map, key-custody review, supplier-chain map, audit-readiness and remediation plan. Full day-by-day methodology: Platform Readiness Assessment.
Case studies
Nine anonymised case studies are published on the case studies page, in anonymised form where the customer requires it — including a private cloud in a bank and a three-data-centre sovereign public cloud. Reference calls are arranged under NDA where the customer agrees.
"Running Nuvolos on sovereign bare metal meant we needed hyperscaler-grade multi-tenancy without the hyperscaler. Cozystack delivered exactly that — isolated tenants, shared GPUs, KubeVirt for legacy workloads — and it's why we can promise our customers infrastructure control, not just a workspace."
Alexandru PopescuCEO, Nuvolos
Pricing and engagement scope
The sovereignty-emphasized engagement runs as a Platform Readiness Assessment.
14-day (focused sovereignty scope)
Sovereignty workstream depth, single regulatory framework, single domain. Data-residency map, key-custody review, supplier-chain (to second hop), remediation plan. On request
28-day (full sovereignty + adjacent)
Sovereignty + adjacent regulatory overlap (DORA / NIS2 / sectoral / GDPR mapping). Multi-BU stakeholder interviews. Vendor shortlisting where applicable. Phase 2 implementation roadmap. On request
Fixed-price. Single invoice. Mutual NDA at kickoff. Phase 2 implementation cost: assessment fee credited subject to scope.
We accept RFI / RFP through standard procurement channels; EU contracts are with AENIX s.r.o. (Czech Republic). The discovery call covers procedural fit.
Start with a 30-minute discovery call
We confirm fit, narrow the scope to the regulators or procurement clauses that bind you, and name the 14-day or 28-day variant.
Or read more:
- Data residency requirements 2026 — practical guide
- DORA compliance for cloud infrastructure — regulatory adjacent trigger
- Cloud repatriation — when sovereignty + cost align
- Platform Readiness Assessment — engagement methodology
- Cozystack — sovereign-by-architecture platform
Ænix created Cozystack — a CNCF Sandbox project, CNCF Certified Kubernetes distribution, OpenSSF Best Practices — and co-maintains it. AENIX s.r.o. holds ISO/IEC 27001:2022 certification.