Sovereign clouds are becoming a big deal again

For companies that are required to keep data within a specific country or region, a sovereign cloud may be a key part of a multicloud deployment.

Cloud-using industries such as banking, insurance, healthcare, and the public sector face additional challenges complying with laws and requirements within specific regions. This has increased the demand for sovereign clouds. This cloud architecture approach seems to fly under everyone’s radar; thus, I’m bringing it up.

Sovereign clouds are semipublic cloud services owned, controlled, and operated by a particular country, region, or sometimes a cloud provider serving a region. They may be owned by the local government outright or by a consortium of private and public organizations.

In a few cases, they are owned by private companies that work closely with the government. The objective is to provide computing infrastructure that can support specific government services, especially protecting sensitive data and complying with laws and regulations specific to a country or region.

Back when we were first formulating the idea of cloud computing and how to define it, a few of us kicked around the term sovereign cloud. However, the concept never took off, and the industry focused on mega cloud providers that served all countries. That’s where we are right now.

Even those moving to sovereign clouds will likely continue to need the hyperscalers for some systems that are less cost-effective to run on sovereign clouds. Indeed, we’re finding that sovereign clouds are just becoming part of multicloud deployments. The acceptance of multicloud and its flexibilities also seems to drive new interest in sovereign clouds today.

The benefits of sovereign clouds

Sovereign clouds provide increased control and ownership of data, ensuring that data is stored and managed in compliance with local regulations and laws, including keeping data in specific countries or regions. With public clouds, you could run the risk that your data may be moved outside of the country for innocent reasons, such as backup and recovery operations. Sovereign clouds avoid this risk since they physically exist in the country they support.

Sovereign clouds offer enhanced security measures, including encryption, access controls, and network segmentation that also may be tailored to specific countries or regions. Of course, the larger public clouds can provide the same or better services, but the fact that sovereign cloud security systems are purpose-built for a specific country’s laws and regulations means that they should be better at supporting data security measures for that country.

Sovereign clouds offer higher service availability and reliability levels than commercial cloud providers, or so they claim. Given that their systems are physically closer to the users and connected applications, that indeed may be the case.

Sovereign clouds can be customized to meet the specific needs of a country or organization, including compliance requirements, data storage, and processing capabilities. Also, sovereign clouds can create jobs and contribute to local economic development as governments and organizations invest in building and maintaining the necessary infrastructure.

By providing a transparent and accountable data management framework, sovereign clouds can help build trust with citizens and customers who may be concerned about data privacy and security. Moreover, they may offer greater independence from commercial cloud providers, reducing dependence on foreign technology and infrastructure.

Again, some of this is perception versus reality. The best analogy is someone who thinks the produce is better in a small neighborhood grocery store than in a big box store, but both stores purchase their produce from the same farms.

The drawbacks of sovereign clouds

So, why don’t companies run to their specific sovereign cloud providers? Here are a few reasons. Sovereign clouds may be incompatible with other cloud infrastructures, which can lead to interoperability and data exchange issues.

Although sovereign clouds aim to increase data privacy and sovereignty, there are concerns that governments could use them to collect and monitor citizens’ data, potentially violating privacy rights. Many companies prefer to use global public cloud providers if they believe that their local sovereign cloud could be compromised by the government. Keep in mind that in many cases, the local governments own the sovereign clouds.

Sovereign clouds may be slower to adopt new technologies and services compared to global cloud providers, which could limit their ability to innovate and remain competitive. Consider the current artificial intelligence boom. Sovereign clouds won’t likely be able to offer the same types of services, considering that they don’t have billions to spend on R&D like the larger providers.

Organizations that rely on a sovereign cloud may become overly dependent on the government or consortium operating it, limiting their flexibility and autonomy.

As multicloud becomes a more popular architecture, I suspect the use of sovereign clouds will become more common. Some companies that serve a specific country will move to sovereign clouds to better align with the local regulations and laws. This is a valid option for many companies and should always be considered as part of a cloud computing portfolio.