October 1, 2026
Generic cloud providers expose data to multi-jurisdictional legal drift and hidden control plane subpoenas, regardless of physical storage location. Shifting sensitive applications to localized, single-tenant bare metal ensures clear boundaries for jurisdictional data control and first-party custody.
In advising organisations across the market, Liber has seen a common strategic oversight: assuming that geography equals jurisdiction. The expansive use of hyperscalers has led to scenarios where decision-makers are thinking a lot about where their data is stored, but neglecting the question of who they can be forced to hand their data over to.
When compliance requires data to stay within a specific country, it's common to assume that selecting a local region in a public cloud console covers you. Data sovereignty, however, isn’t just about geography. Choosing Austria or South Korea as a hyperscaler region determines the data’s physical location, but it’s not the only factor in its legal jurisdiction. The 2018 US CLOUD Act, for example, lays out very clearly:
“A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”
The US is the most explicit example, but other authorities are implementing similar laws. Since 18 August 2026, the EU's e-Evidence Regulation has let a court in one member state order a service provider in another to hand over data directly. The UK's Investigatory Powers Act, Australia's Assistance and Access Act and China's National Intelligence Law give their governments similar leverage. Standard cloud encryption doesn’t close this gap either: if the provider manages the keys, it can comply with an order on your behalf.
All of this puts global cloud providers and their customers in a difficult position. A US-headquartered cloud provider hosting data for a European healthcare firm is caught between legislation like the CLOUD Act and local privacy laws such as GDPR. When forced to choose, they usually defer to the laws where their corporate charter sits and their executives therefore face liability.
Microsoft France illustrates this reality well. It’s headquartered in the US but has several EU subsidiaries, third-party support staff on other continents, and data centers across the world. Microsoft France’s director of legal affairs confirmed to the French Senate that it couldn't guarantee that French citizens’ data wouldn't be handed to the US without French authorization.
The legal vulnerability, however, extends beyond direct subpoenas to corporate or subsidiary headquarters. The vast operational architecture of a public cloud provider exposes it to potentially dozens of foreign jurisdictions simultaneously, creating routes to your data that never appear in your contract.
Large cloud providers typically use both third-party customer support teams and IT contractors that may exist in a variety of legal jurisdictions. Support personnel in India, for example, may become a legal vector for local courts and law enforcement. Firms could receive binding orders that end up divulging the sensitive data or credentials of organizations in other countries.
While primary databases often sit in a local data center, the underlying control plane that orchestrates hypervisors, identity access management, and routing is typically global. API calls, authentication tokens, and admin requests frequently cross international borders and could be subject to action from a foreign court or intelligence agency regardless of your local geographic boundary.
Public clouds collect a huge amount of telemetry, including access logs, network routing, platform stability metadata, and so on. This is usually pushed back to its primary corporate headquarters for analysis, with many legal frameworks not treating it with the same statutory protections as other types of data.
For businesses offering privacy-focused services, then, it becomes less about where their data sits and more about what data is available, how many countries can reach it, and whether they’ll find out.
When a legal order arrives, it goes to the provider rather than the business that is paying for their infrastructure or their customers. While some providers commit to notifying customers unless the law prohibits it, that legal qualifier does a lot of work. As we saw in 2016 with Microsoft’s lawsuit, providers can be compelled to stay quiet. According to the company, it received more than 5,000 federal demands for customer data in about 18 months, and nearly half came with a gag order. Secrecy isn’t limited to the US, either. The UK, Australia, and others have similar capabilities. The same opacity applies on shared hyperscale platforms: an order aimed at another tenant can affect hardware you rely on, and you may never be told why.
In most legal systems, the provider still has the right to push back and raise conflicts of law. That, however, is the provider’s tool to decide when to exercise it, not the businesses or customers renting its infrastructure. They aren’t a party to the argument and may never learn it took place.
Legal orders aren’t a bad thing. Almost all companies want to comply with local laws and ensure their platform isn't being misused. The difficulty comes from the complex web of overlapping jurisdictions that global cloud infrastructure introduces. When the underlying platform spans multiple foreign entities, determining your legal obligations and offering clear privacy guarantees to customers becomes much harder.
Building a sovereign network architecture isn't about avoiding legal oversight; it’s about being intentional about which legal frameworks govern your systems. It means developing clear structural boundaries for jurisdictional data control, so that you know what orders you’re subject to and who could receive them.
The most direct route to achieving this level of control is, of course, to keep your data center in-house. While this grants the best physical and legal autonomy, it requires significant expertise, up-front investment, and ongoing operational overhead that most small to medium businesses can’t justify. Working with a dedicated full-stack infrastructure partner is another alternative. You can work with a company such as Liber to build single-tenant hardware and localized control planes without the burden of doing so in-house.
When building out a sovereign architecture, there are three main areas you need to consider.
Working with a full-stack service provider in your jurisdiction allows you to deploy purpose-built hardware without inheriting extraterritorial legal vulnerabilities. As long as the infrastructure provider has no foreign parent company, foreign governments generally cannot issue direct subpoenas. They usually have to rely on MLATs and bilateral agreements, which typically require the conduct to also be an offense in the local jurisdiction. Some bilateral agreements, such as the US-UK data access agreement, do create direct routes, so this narrows exposure rather than removing it.
This legal insulation is enforced on the operational side. Moving away from centralised platforms allows you to ensure that your network and administrative access stay within your borders. Domestic teams can back this up with system maintenance and support, reducing the risk of an offshore worker being legally compelled to provide access.
Naturally, if you want to serve a global audience, you can’t keep everything in-house. That said, going global doesn’t mean that you need to expose yourself to a massive hyperscaler footprint. Organisations can bundle their architecture by keeping their stateful core of sensitive databases, PII, and IP on their dedicated local servers.
For faster load times in foreign markets, organisations can use independent CDNs and transport providers. While they could theoretically be subpoenaed by their local courts, the risk is reduced by the architecture if you have properly separated your systems and encryption keys.
Zero-access encryption helps ensure that partners, including those in other regions, cannot provide data to authorities even if subpoenaed. Building systems so you are the exclusive holder of cryptographic keys helps ensure ultimate data custody and disclosure decisions remain in your hands.
Beyond that, however, privacy-focused businesses can take steps to store as little comprehensible user data as possible. For example, by collecting minimal data at sign-up, not running trackers on their website, or letting users manage their own private encryption keys so they couldn’t access their data even if they wanted to.
Private cloud infrastructure security is not only a technical question of firewalls and access controls. It also depends on whose laws can reach the stack. While using global cloud services works for many companies, it leaves them at the mercy of foreign legislative changes and extraterritorial court rulings. If you are in the healthcare, defense, financial services, or privacy industries, that jurisdictional ambiguity is often unacceptable.
Hosting on infrastructure a foreign entity can reach exposes the business to threats that are hard to quantify: proprietary IP could be compromised by foreign state actors under the guise of legal discovery, extraterritorial gag orders could prevent the board from ever knowing their data was accessed, and shared hardware environments can cause collateral, revenue-affecting downtime if a co-tenant is targeted by authorities.
When a data center compliance strategy is architected correctly, data sovereignty transforms into a distinct competitive advantage, one that can be the difference between winning a major contract or losing it.
In June 2026, for example, the EU Commission proposed the Cloud and AI Development Act (CADA), an EU-wide framework for assessing cloud and AI sovereignty across four assurance levels. At the highest level, providers need full transparency and control over their software supply chain and zero interference from a third country. While still a proposal, CADA is a clear indicator of how absolute infrastructure sovereignty is becoming an expected attribute in the public sector.
Ultimately, moving to sovereign infrastructure is about protecting what makes your company valuable: its IP and your customer base. When you rely on a global cloud provider, both are usually subject to foreign laws and overseas courts. For highly regulated industries, that could be an existential risk.
At Liber, we believe your infrastructure should be your strongest asset rather than a hidden vulnerability. That means reducing the hidden risks of foreign parentage and bringing your most valuable assets back under your own legal control.