Data sovereignty for security operations: what is actually checkable

Residency answers where bytes are stored. It is verifiable, it appears in contracts, and it is what most sovereignty pages actually describe.

Sovereignty answers which legal system governs compelled access. That turns on three things that have nothing to do with geography: which entity operates the service, who ultimately controls that entity, and which legal orders bind it. A European subsidiary of a foreign parent is a European company with a foreign chain of control, and both halves of that sentence matter.

For most software the gap between the two is theoretical. For a detection platform it is not, because the data in question is the record of who accessed what across your entire estate, which is precisely the material a compelled-disclosure regime would be interested in.

The FTC has accumulated vast rulemaking, enforcement and adjudicatory powers, and it unquestionably exercises executive power, and must therefore be controlled by the Chief Executive, in whom such power is vested.

A detection platform is granted the broadest read access in the organisation by design. It ingests authentication events, endpoint telemetry, network flows and the contents of alerts, and it retains them long enough to investigate. That makes it a single place where the shape of the whole business is legible.

Model-driven tooling extends the exposure in a way architecture diagrams often miss. Alert context is sent to an inference endpoint, and that endpoint is a separate contractual arrangement with a separate location. A pipeline hosted in Europe that calls a model elsewhere has moved the data without moving the diagram.

This is also where the answer is unusually easy to give if a vendor has thought about it. The hosting region, the model provider and the inference location are three facts, and a vendor who cannot state all three in a sentence has not decided them.

Sovereignty is not itself a legal requirement in the EU. There is no article that says security tooling must be EU-operated, and a vendor implying otherwise is overstating.

What exists instead are three adjacent requirements that make the question unavoidable. GDPR Chapter V governs transfers of personal data to third countries and requires a lawful mechanism for each one. NIS2 Article 21 makes supply chain security a risk management requirement in its own right, so your detection vendor's dependencies are inside your assessment. And for financial entities, DORA Article 28 requires contractual terms including where the service is provided from.

Read together, the effect is that you do not have to argue that sovereignty matters. You have to be able to describe your arrangement, and describing it is what surfaces the problem when there is one.

It is worth saying plainly, because it explains why so much writing on this subject is unsatisfying. The pages that currently rank for data sovereignty come from infrastructure vendors, and between them they cite almost no legal instruments at all.

That is not laziness. An infrastructure vendor writing about sovereignty has a commercial reason to keep the discussion at the level of regions and certifications, because that is the part they can sell. Citing GDPR Chapter V invites the question of which transfer mechanism they rely on, and citing a pending appeal invites the question of what happens if it succeeds.

The practical consequence for a reader is that the available material describes the solvable half of the problem in detail and the unsolvable half not at all. This hub tries to do the opposite, which is why every page here carries its sources.

Run the analyst on Anthropic, or an EU-hosted model that meets your residency rules.

The legal basis for transfers to the United States remains in force. The EU-US Data Privacy Framework adequacy decision has not been suspended or annulled, and transfers made under it are lawful today. A challenge brought by Philippe Latombe was dismissed by the General Court on 3 September 2025, and an appeal is pending before the Court of Justice as Case C-703/25 P with no hearing date set.

What did change is the argument underneath it. On 29 June 2026 the US Supreme Court decided Trump v. Slaughter, overruling Humphrey's Executor, which had held that Congress could protect Federal Trade Commission commissioners from removal except for cause such as inefficiency, neglect of duty or malfeasance in office. The Court held that the FTC exercises executive power and must therefore be controlled by the Chief Executive.

The European Data Protection Board wrote to the Commission about that judgment. The relevance is that the FTC's independence was part of what the Commission relied on when it assessed adequacy, so a change to that independence is a change to a load-bearing element of the assessment, whatever the eventual outcome.

For a buyer the practical reading is narrow and useful: the mechanism is valid, and the mechanism is contested. An arrangement that does not depend on it is not more lawful today, but it is less exposed to a change in the assessment.