Sovereignty, or simply knowing where your data lives

The word sovereignty is made to cover almost anything these days. The demand, though, can be measured: according to Gartner, European spending on so-called sovereign cloud infrastructure grows 83% in 2026, and Europe is set to overtake North America on that line by 2027. What is sold under the name is more debatable, and the same firm says as much in its own way: treating sovereignty as a pure security and compliance topic is not enough to answer it.

The two findings go together. The demand is real, what is being sold in answer to it far less so, and almost no European organisation is genuinely independent of an American supplier.

The question clients are actually asking

When you listen to what is being asked rather than to the word used to ask it, the question is narrower and much more verifiable. Where the data lives. Under what legal basis. Who can reach it.

Those three questions have written answers that can be produced on demand, and they depend on no political position. Those are the ones we deal with.

What self-hosting settles

The flow engines we use are open, n8n first among them, and they install on a machine the client controls. An open language model, Mistral or Llama, can run on their own servers where sensitivity demands it, or with a European host where it does not.

The two combine, and that is often the right configuration. An innocuous question goes out to a shared service, a question containing a patient’s name stays inside the walls. The sorting rule is decided once, written down, and verified afterwards in the logs.

What it costs, said beforehand

A self-hosted model needs a machine, its updates and its monitoring. At equal budget it will perform less well than an online service. That is not an implementation detail, it is the central trade-off, and it has to be put before signature rather than discovered in the first quarter.

For many uses, the right answer is not to self-host. For a patient record, a public tender document or a contract under a confidentiality clause, it is.

Claiming is not enough, you have to be able to show

This is the point that changes everything for a public buyer. A declaration of compliance is worth nothing without the material supporting it: where the machine runs, who has access, what is logged, how long it is kept, and what happens when a supplier leaves.

A tender submission that supplies those answers passes. One that writes “sovereign solution” and nothing else does not, and it should not.