Data sovereignty: definition, stakes and 10 questions to ask

This article is for information only and is not legal advice. Rangee is our product; the texts cited were checked on 3 November 2026.

Data sovereignty means staying in control of your data: it stays subject to the law you chose, and only you decide who can access it. The term has been everywhere since 2020. It is also often reduced to a sales line: "your data is hosted in Europe".

That line is not enough. A server in Paris or Frankfurt, run by a company subject to a foreign law, does not shield data from that law's demands. This guide gives a usable definition, the concrete stakes in 2026, and ten questions to ask a provider before you hand over your customer files, your stock or your member list. For the most cited US law in detail, see our guide to the CLOUD Act.

What is data sovereignty?

Data sovereignty is the ability of a company, a nonprofit or a state to decide which law applies to its data and who can access it. It does not depend first on where the servers are. It depends on the law that governs the companies that control the data.

The word comes from the language of states. Applied to data, it asks a simple question: if a foreign authority demands your data from your provider, can that provider be forced to hand it over? If so, your data is not sovereign, whatever country the data centre is in.

Three related ideas are often confused:

Residency is a useful condition, rarely a sufficient one. A US provider can offer European residency without offering sovereignty. Airtable, for example, offers European data residency on its Enterprise Scale plan; the provider remains a US company, subject to section 2713 of the US Code, which covers data under its control "regardless of whether" it is located in the United States.

Why does data sovereignty matter in 2026?

In 2025, according to a Synergy Research Group release of 24 July, European providers held only 15% of the cloud market in Europe, down from 29% in 2017. Amazon, Microsoft and Google held 70%. Most European data therefore depends on companies subject to a foreign law.

Meanwhile, the cloud has become the norm in business. According to Eurostat, 52.7% of EU enterprises bought cloud services in 2025, up from 45.3% in 2023. The main uses are e-mail, office software and file storage: exactly the data people forget to protect.

Public authorities have drawn conclusions from this dependence. On 17 April 2026, the European Commission announced four sovereign cloud contracts worth up to EUR 180 million over six years. In France, Decree No. 2026-272 of 14 April 2026, issued under Article 31 of the SREN Act, governs how central government services may use private cloud providers for their most sensitive data.

These rules target governments and large buyers. But they set a method any small business can reuse: stop asking "where is my data?" and ask "which law applies to each company that touches it?".

What are the four parts of data sovereignty?

For that tender, the European Commission measured the sovereignty of cloud services against eight objectives, set out in its Cloud Sovereignty Framework. For a work tool, four parts are enough to get a clear picture: legal, operational, technical and reversibility. One weak part is enough to weaken the whole.

The legal part: who controls the data?

This is the deciding part. It covers the nationality of the provider, of its parent company and of each of its sub-processors: hosting, backups, e-mail delivery, support, AI. A European provider that stores its files with a US host exposes those files to US law, through the host.

Microsoft France admitted as much before the French Senate on 10 June 2025. Questioned under oath, its director of public and legal affairs said, according to the official record, that he could not guarantee that French citizens' data would never be handed over under a US order.

The operational part: who runs the service and who can access it?

A service can be hosted in Europe and administered from another continent. Technical support, on-call staff and the engineers who can reach the databases matter as much as the data centre. The Commission's framework puts this under operational sovereignty: the ability to run and maintain the service without depending on foreign control.

The technical part: who holds the keys?

Encryption protects you if only you hold the keys. If the provider holds them, it can read the data and may be forced to hand it over in clear. Most collaborative tools (databases, CRMs, project tools) must read the data to display and sort it: end-to-end encryption is rare there. The technical part does not replace the legal part.

Reversibility: can you leave with your data?

Sovereign data is data you can take with you. A complete export, in an open format, without disproportionate fees, is what lets you change provider if its rules change. The EU Data Act makes this an obligation for cloud services, with precise dates (see below).

Reversibility is the most neglected part, and the only one you can test yourself in ten minutes: export a complete database, then try to open it somewhere else.

What does EU law say about data sovereignty?

No EU text defines "data sovereignty". Two regulations still lay its foundations. The GDPR governs personal data and its transfers outside the EU. The Data Act, which has applied since 12 September 2025 according to the European Commission, also covers non-personal data and switching between cloud providers.

The Data Act brings two concrete things. First, according to the Commission's explainer, cloud providers must take "all reasonable measures" (encryption, audits, certification) against unlawful access by foreign authorities, and publish those measures on their websites. Second, it removes switching charges entirely, data egress included, from 12 January 2027.

These texts have a limit. They bind providers that serve the European market, but they do not cancel a foreign law that binds the same provider. A US provider remains caught between two legal systems. Our guide to the CLOUD Act explains how.

Do you need a SecNumCloud-qualified cloud?

For most small businesses and nonprofits, no. SecNumCloud, from the French cybersecurity agency ANSSI, is a demanding security qualification that requires, among other things, a provider that is European by its head office and its capital. It targets sensitive data: health, government data, operators of vital importance.

A small business that manages quotes, stock or a member list does not carry that level of risk. It needs three simpler things: a provider subject to European law, known sub-processors, and an export of its data. A stock spreadsheet does not call for the same precautions as a medical record.

So the right question is not "is this tool sovereign?" but "is this tool sovereign enough for this data?". Sort your data into three levels: routine, personal, sensitive. Then choose your tools accordingly.

10 questions to ask a provider

These ten questions cover the four parts. You can send them by e-mail before signing, and a serious provider answers in writing within a few days. Since 12 September 2025, the Data Act already requires cloud providers to publish part of the answers on their websites.

These are the questions we ask ourselves before adopting a tool, and the ones we answer for Rangee below.

Legal

1. Which company signs the contract, and where is it registered? Read the terms of service, not the home page.
2. Who owns that company? A European subsidiary of a US group remains subject to US law for the data it controls.
3. Can you send me the full list of your sub-processors, with their countries? Hosting, backups, e-mail, support, payment, AI: each one counts.
4. What do you do if a foreign authority asks for my data? Look for a commitment to challenge unfounded requests and to notify you when the law allows.

Operational

5. In which countries are your data centres, backups included? Backups are often somewhere other than production.
6. Who can access my data, from which countries, and in which cases? Support, engineers, contractors.

Technical

7. Is my data encrypted at rest and in transit, and who holds the keys? A vague answer here tells you a lot.
8. Is my data used to train an AI model, and where does that model run? An AI feature can send your data to a sub-processor you had not spotted.

Reversibility

9. Can I export all my data, attachments included, in an open format, at no cost? Test it during the trial.
10. What happens to my data when the contract ends, and how fast is it deleted? The data processing agreement (DPA, Article 28 of the GDPR) should say.

These questions also help you read a comparison. In our comparison of European Airtable alternatives, the "provider's country" column matters as much as the price; our comparison of free inventory software likewise shows where each provider hosts its data.

And Rangee?

Here are our answers to the ten questions, in short. Rangee is published by a company under French law. The content of your bases is hosted in a data centre in the European Union, with Hostinger International Limited, a Cypriot company according to its terms of service. The AI model behind smart import runs in the EU.

An honest chain has limits too, and we state them. Payment goes through Stripe, a US group: it processes your billing data (name, address, payment method), not the content of your bases. And like any company, we remain subject to French and European legal orders.

We do not promise to escape every law: nobody can. We promise what can be checked: a provider under French law, bases hosted in the EU, named sub-processors. On cost, our no-code database pricing survey compares Rangee with other tools, European hosting included.

If you want to see what a spreadsheet becomes in a tool hosted in Europe, join the Rangee beta: the Free plan never expires, and readers never pay.