Data sovereignty: residency is the starting point, not the destination
Most organizations asking about data sovereignty are actually asking about data residency. Where are the servers? Is there a data center in Germany, France, or the Netherlands? The vendor says yes. The procurement box gets ticked. The conversation moves on. This is understandable. Geography is concrete and auditable. And residency does matter. What it does not do is answer every question sovereignty requires. That gap is where the real sovereignty conversation begins.