Key findings
Data residency alone rarely satisfies requirements for operational sovereignty.
Moderate confidenceHybrid designs carry integration costs that are often underestimated at selection.
Moderate confidenceExit planning is the most neglected part of cloud contracts.
High confidence
Context
Regulators, customers and boards increasingly ask not only where data is stored but who can operate the systems that hold it. This report compares the options available to regulated organisations and the trade-offs each involves.
What we recommend
- Separate residency, operational control and legal jurisdiction when writing requirements.
- Cost the integration of hybrid designs at selection, not after.
- Negotiate and test an exit plan before signing.
How we reached these conclusions
This report draws on 57 sources, including structured interviews with practitioners, client inquiry data, vendor briefings checked against reference customers, and public disclosures. Vendor claims are never counted as evidence on their own. Each finding is graded in the Krynthnode confidence ledger, described on our methodology page, and the whole report is due for review by 8 January 2027.