Data Sovereignty

Data sovereignty is the right to decide for yourself where your information is physically stored and whose rules it follows. It's like choosing whether to keep valuables in your own safe at home or in a neighbor's storage shed. The item itself doesn't change, but which storage you choose determines who's responsible if something goes wrong and which local rules apply.

The same issue comes up when companies use AI services. If sensitive material like a company's chat logs or code is handed over to an AI company's servers as-is, it ends up following the laws of whatever country those servers are in, along with that company's security policies. In heavily regulated industries like banking or healthcare, companies often insist on keeping their data in the cloud storage they already use, and holding the keys themselves.

Recently, as AI companies increasingly retain usage data for a period of time to catch new types of threats, security needs and data sovereignty often end up in tension. Even if retention itself is necessary, where the data physically sits remains a separate question.

Anthropic had been storing enterprise data from users of Claude's latest models on its own servers for 30 days, but after pushback from customers in regulated industries citing data sovereignty concerns, it decided to move storage to customers' own cloud environments. A common misconception is that data sovereignty means data is never handed over at all — in practice, it's closer to keeping the retention obligation itself intact while letting the customer control physical storage location and access rights.