The Sovereignty Scorecard.

"Sovereign" has become the most accommodating word in cloud marketing. It can mean a data centre with a local flag, a region on a pricing page, a reseller agreement with a domestic logo on top. Most clouds that use the word mean something narrow: your data is stored nearby. That is residency, and residency is one layer of six.

Sovereignty is better understood as a chain of control. Where the data lives. Who can touch the running systems. Whose courts can compel access. Who controls the software that operates the stack. Who stands in the hardware and recovery path. And whether any of this is independently certified, or merely asserted. Each layer is a separate door into the same room, and locking five of them is the same as locking none.

What makes this hard to see is that the layers fail independently, and quietly. Data can sit in Sydney while the administrators who manage it sit elsewhere. A provider can be locally incorporated and still owned from a jurisdiction whose laws reach through subsidiaries. None of these gaps shows up on a compliance slide. They show up later, in a courtroom, an outage, or an audit.

Health data raises the stakes, because it outlives every contract it is stored under. An imaging archive carries retention obligations measured in decades, which means the legal weather will change several times over its life. Choosing infrastructure is not deciding where data sits this year. It is deciding whose law it answers to for the next thirty. That is why the scorecard below asks six questions instead of one, and why the most useful result is not the score. It is the layer you had not thought to ask about.