Where does your business data actually live? Digital sovereignty and the systems you run on

On 24 September, the White House asked America’s leading AI companies to stop giving the UK government’s AI Security Institute early access to their new models. For seventeen days, British government scientists were shut out of testing they had come to rely on. On 11 October, after ministers lobbied Washington, the decision was reversed.

Most businesses will never need early access to an AI model. But the episode is a useful reminder of something easy to forget: access that one country depends on can be changed from another, at short notice, by a decision neither party’s customers get a say in. That is what the phrase “digital sovereignty” is really about, and it applies to the systems your business runs on every day.

Our solution to this problem ↓

Digital sovereignty in plain English

Digital sovereignty is about who has legal and practical control over your data and the systems that hold it. It isn’t only a question of where a server sits. It is also a question of who owns the company running that server, which country’s laws can compel that company to act, and what happens to you if its priorities change.

Why ownership matters: the US CLOUD Act

The clearest example is the US CLOUD Act. It allows US authorities to require US-based providers to hand over data in their “possession, custody, or control”, wherever in the world that data is physically stored. Choosing a “UK region” from a US cloud provider keeps your data on British soil, but it doesn’t take it outside US legal reach. Microsoft has acknowledged that it cannot guarantee the sovereignty of European data held in its services.

None of this means US providers are acting in bad faith. The large providers say they challenge requests they consider invalid. The point is simply that the decision may not be theirs, or yours.

Europe is moving. The UK is still deciding.

In June, the European Commission proposed new rules that would keep the largest US cloud providers out of the most sensitive public-sector work across the EU. The UK has gone more slowly. The House of Commons Library notes that the government has no overarching policy on digital sovereignty, and campaigners are pressing for one to be added to the Cyber Security and Resilience Bill, which is currently going through Parliament.

Those debates are mostly about government data. But the questions they raise apply just as much to a firm of twenty people.

Why it matters most for your business systems

Your website tells the world about your business. Your business system is where the business actually lives: client records, contracts, inspection reports, compliance certificates, staff details, quotes and financial history. If anything deserves a deliberate decision about where it is held and who controls it, it is that.

The realistic risks are rarely dramatic. They look like this:

• Foreign legal reach. Your clients’ data could be subject to another country’s laws without you, or them, being told.
• Changes you don’t control. Pricing, terms, features and access are set by a supplier whose decisions are shaped by its own market and its own government.
• Transfer paperwork that can be undone. Sending personal data outside the UK relies on legal agreements between governments. The EU–US Privacy Shield, which thousands of businesses relied on, was struck down overnight in 2020.
• Harder answers for your own clients. More clients, particularly in construction, healthcare and the public sector, now ask where their data is held. “Somewhere in the cloud” is no longer a good enough answer.

To be clear, this isn’t an argument for avoiding all US technology. Almost every business uses some, and much of it is excellent. It is an argument for making the choice deliberately, and for being most careful with the systems that hold your most sensitive and operational data.

Five questions to ask about any system that holds your data

• Where is the data physically stored? Not “in the cloud”, but which country and, ideally, which data centre.
• Who owns the company that runs it? And which country’s laws could require that company to hand your data over?
• Can you get all of your data out, in a usable format, without asking permission? If not, you are renting access to your own records.
• What happens if the supplier changes its price, terms or availability? Do you have notice periods, alternatives and a plan?
• Which other services does the system send data to? Email, payments and AI features often route data through third parties. Know which ones, and where they process it.

How Cirrus approaches it

The bespoke business systems we build are hosted primarily with Fasthosts, a UK hosting company headquartered in Gloucester, on servers in UK data centres. Fasthosts has no US parent company, so the systems that hold our clients’ most important records are not run by a business that US law can order to hand them over.

Because the systems are built for you, you own them and the data in them. Where a system connects to an outside service, such as email delivery or an AI feature, we can tell you exactly which ones and where they process data, so the choice stays yours.

The lesson of the last few weeks is not that anyone should panic. It is that the rules governing digital services can change quickly, and from a long way away. The businesses that know where their data lives, and who controls it, are the ones best placed to cope when they do.

If you’d like to know where your own business data sits today, and what it would take to bring it under your control, get in touch with the Cirrus team in Poole.

Get in touch Our business systems

This article is for general information only and is not legal advice. If you have specific data protection obligations, take advice from a qualified professional.