DIGITAL SOVEREIGNTY

Sovereignty is about control.

Where your data is stored matters. But it is only part of the question.

Aegis is delivered as one managed environment. OpexIT.Services holds the underlying software licences, so customers are not managing a stack of separate software-vendor EULAs.

To understand who really has control, look at three things:

  1. WHERE IS YOUR DATA?

    Where are the data and backups held?

  2. WHO SITS BEHIND THE TECHNOLOGY?

    Who operates it, which providers does it depend on and which laws can reach them?

  3. WHAT HAVE YOU AGREED THEY CAN DO WITH YOUR DATA?

    What rights do providers have to access, process, use or share your data and metadata?

Local data does not always mean local control.

A provider can store your data in a data centre in your country while the company behind the service remains subject to laws somewhere else.

Legal reach can follow the provider, not just the data.

Many businesses rely on large US cloud and technology providers. Moving data into a local region does not necessarily remove the US legal and intelligence powers that apply to the provider.

Three different mechanisms. One reason the provider matters.

The provider at the centre, with three separate legal mechanisms that can reach it: the CLOUD Act, FISA Section 702 and Executive Order 12333 The provider CLOUD ACT EO 12333 FISA 702
  • CLOUD ACT

    A covered US provider can be legally required to produce data within its possession, custody or control, including certain data stored outside the US.

  • FISA SECTION 702

    Covered US communications providers can be required to assist authorised foreign-intelligence collection targeting non-US persons outside the US.

    Section 702 expired in June 2026, but existing authorisations continue, with the current programme publicly reported to run into March 2027.

  • EXECUTIVE ORDER 12333

    US intelligence agencies can conduct foreign signals-intelligence collection through communications systems around the world.

Moving the data does not necessarily move it beyond the reach of the provider’s jurisdiction.

US law is one example of why provider jurisdiction matters. We apply the same sovereignty test to every provider, wherever it is based.

What you depend on matters.

Sovereignty does not mean eliminating every external dependency. It means understanding what your technology relies on, choosing those dependencies deliberately and reducing the ones that materially weaken your control.

Know it. Choose it deliberately.

How we put sovereignty into practice.

We make these choices deliberately when we build and operate our technology.

  1. KEEP CONTROL LOCAL

    Aegis is designed around in-country infrastructure, customer data and backups, with local operation and accountability.

  2. CHOOSE WHAT SITS BEHIND THE TECHNOLOGY

    We consider the providers, infrastructure, jurisdictions and dependencies behind the environment, not only where the data is hosted.

  3. KEEP CUSTOMER DATA AS CUSTOMER DATA

    We use customer data to deliver and operate the service. We do not sell it or use it for advertising.

Your data is not the business model.

More capability should not mean less control.