Data Sovereignty in the Age of Cloud Convenience
A Decision Framework for Operators Handling Named-Human Data
The cloud-versus-local debate is usually framed as a security question. It is not. Security is one axis of four. When a cloud provider's security is assumed sufficient, four non-security exposures remain: legal discoverability, availability dependency, jurisdictional drift, and provider-policy risk. This paper argues that sensitivity-based partitioning is the wrong decision variable. The correct variable is control loss cost, and the operational rule that follows is simple enough to write on a card.