Sovereign Cloud Is an Architecture, Not a Procurement

Tue, 29 Sep 2026 00:00:00 -0400

The agency in this story is a composite, drawn from several engagements, though every detail in it is one we’ve seen. It signed a sovereign cloud contract after a careful procurement. The platform was certified, the data would stay in-country, and the provider’s operating entity met the ownership conditions the policy asked for. Well into the second year, a team mapping dependencies for an unrelated migration counted thirty-two services in the agency’s stack that still reached outside the sovereign boundary. The identity directory synchronised to a global tenant. Logs and traces went to a monitoring service hosted overseas, and that vendor’s support staff, in another jurisdiction, could see them. A CI/CD service and a handful of developer tools each had their own route out. Separately, the platform’s key management service was still running on the provider’s defaults, with the settings that would have given the agency its own key custody left for a later phase.

Procurement on Sakura Sky: Cloud, Data, Security

Sovereign Cloud Is an Architecture, Not a Procurement