Server location says little about who can compel access, switch the service off or how fast you could leave. The Four Locks (location, jurisdiction, access, exit) make that call in an afternoon.
"Where is our data?" is usually treated as an IT question with a one-word answer: Ireland, Frankfurt, the United States. It is a good place to start and a poor place to stop. For an international organisation holding beneficiary records, donor information and partner correspondence, the location of a server tells you very little about who can compel access to it, who can switch it off, and how quickly you could leave.
Small organisations do not build sovereign clouds. But they make sovereignty decisions every time they choose a tool, sign a licence or paste a document into an assistant. These are management decisions, and they can be made well with four plain questions.
Data location is a fact about geography. Sovereignty is a fact about who holds the keys.
Storing data in a particular country can help with rules on cross-border transfers and with partner expectations. It does not settle the jurisdiction of the company that operates the service. Under the US CLOUD Act of 2018, for example, US law requires providers subject to US jurisdiction to preserve and produce data in their possession, custody or control regardless of where it is stored. The Act also gives providers a way to challenge requests that conflict with another country's law. The practical point is not that any particular request is likely. It is that a data centre address and a legal exposure are separate things, and a risk assessment that records only the first is incomplete.
The same logic applies to AI features layered on top of storage. A document held in one region may be processed for a summary or a search in another, by a different sub-processor, under different terms. The question is not only where the data sits, but where it goes when you use it.
Each lock is a separate way in which control can be held or lost, and each can be assessed in an afternoon.
A tool does not need to score perfectly on all four. It needs to score well enough on the locks that matter for the data involved.
If you cannot describe how you would leave, you have not yet made a sovereignty decision. You have made a dependency.
The mistake seen most often is applying one standard to everything. A blanket rule that "all data must stay in-region" is either unenforceable or so restrictive that staff bypass it, which is the shadow AI problem in another form. Tie the locks to the data classes the organisation already uses, or should.
This is the same permissions-first logic used for policy generally: state clearly what may go where, rather than banning tools and hoping.
Regional providers and sovereign offerings are multiplying, and they can be the right answer for sensitive data. They are not automatically safer. Ask the same four questions of them as of any other provider, and add two more. First, how mature is the service, including security certification and support? Second, is the model or tool good enough in your working languages and your subject area? A tool that fits your jurisdiction but fails your workflow will be replaced by whatever staff use privately. Weigh the trade-off openly and record it.
Sovereignty for a small organisation is not a location on a map. It is four locks, location, jurisdiction, access and exit, assessed in writing and matched to the sensitivity of the data.
Pick the three AI tools your staff use most. For each, complete a one-page Four Locks assessment from the vendor's own documents and contract, marking every answer as confirmed in writing, assumed or unknown. The unknowns are your risk register. Then test one exit: export your data from one tool and check that a colleague can open and use it.
US CLOUD Act (adopted 23 March 2018): obligation on US-jurisdiction providers to preserve and produce data regardless of storage location, with a provider right to challenge conflicting requests (Congress.gov CRS R45173 and LSB10125; Eurojust summary). No claims are made about specific requests or about international-organisation immunities. The Four Locks is a framework proposed by M.A.I. Consulting.
One AI supplier means one set of prices, terms and roadmaps. The Portability Ladder tests four things: method, data, workflow and account control. Diversify by being able to move, not by buying twice.
Custom Agents & Tools · 6 minGuide · 11 September 2026A one-page, four-class scheme (Public, Internal, Confidential, Restricted) and a single who-is-harmed test that tell staff what can go into a general-purpose AI tool.
AI Use Policy · 4 minGuide · 19 September 2026How to split Legal, Protection, IT and Procurement work between routine tasks AI can draft or triage and decisions that must stay human, such as safeguarding disclosures, contract sign-off and access grants.
Team AI Training · 4 minIf this is the question on your desk, a thirty-minute call tells you whether the service fits, or that you do not need us yet.