Data residency is necessary but not sufficient
Confirming data sits on infrastructure physically located in the UK answers only the residency question. It says nothing about whether support staff with access to that infrastructure are themselves subject to a foreign legal jurisdiction with its own data-access powers — a genuinely separate, and often overlooked, question.
A sovereignty claim should be able to answer both, specifically, in writing, rather than relying on residency alone to imply the rest.
The questions worth asking a vendor directly
Where is data physically stored, who has operational access to it and under what jurisdiction, what legal mechanisms could compel disclosure regardless of residency, and is the operating entity itself a UK legal entity subject to UK courts. Written, specific answers to all four — not a marketing page — are what a genuine sovereignty posture looks like.
Sovereign cloud is a set of specific answers, not a label on a pricing page. Ask the four questions directly, in writing.MNB Cloud Practice
Key actions
- Separate data residency from operational access jurisdiction explicitly
- Ask who has access to the data and under which country's law
- Get written answers on legal mechanisms that could compel disclosure
- Verify the operating entity is itself subject to UK courts if that matters to you