A customer requires data sovereignty. What three questions do you ask before designing anything?

What is being tested

Whether you establish which of three very different obligations applies before committing to an architecture.

The three questions

1. Is this about where data is stored, who can access it, or whether you can operate without a foreign provider?

These are three escalating levels with enormously different implications:

• Residency — satisfied by choosing a region, plus diligence that backups, replicas, logs and analytics also stay there.
• Operational sovereignty — only in-jurisdiction personnel may access the data, including provider support staff. Constrains support models and requires provider commitments plus technical controls limiting administrative access.
• Full sovereignty — the system must be operable independently of a foreign provider. This forecloses provider-specific managed services and implies an exit plan or a sovereign deployment.

Organisations frequently ask for the third and need the first.

2. Which data, specifically, and what about derived data? Personal data, all customer data, or metadata too? Aggregates, embeddings and machine learning models derived from covered data — are those covered?

The answer determines whether cross-region analytics is possible at all, which is a substantial product question.

3. What evidence will satisfy the auditor? A contractual commitment, a technical control, or a demonstrable architecture?

This determines how much of the enforcement must be structural. "We have a policy" satisfies some auditors and not others, and building for the stricter interpretation when the looser one applies is an expensive misreading.

The follow-up that matters

Is this a regulatory requirement or a customer preference? A regulation is a hard constraint. A preference in a procurement questionnaire is negotiable, and it is frequently answered by a well-documented control rather than by a re-architecture.

The architecture that satisfies the common case

Per-region cells with a thin global control plane holding nothing covered — which makes residency structural rather than enforced by code review, and accommodates the stricter levels later if needed.