Principle 1
Know where the data lives
Residency is a starting point, not the whole answer. Map storage, backups, logs and derived data to jurisdictions — including the providers behind the provider.
Sovereignty
Sovereignty is the ability to know where your data lives, who can reach it, which laws apply, and how you leave. Wombat makes those questions scoreable.
- Control, not just location
- Residency · Access · Exit · Evidence
- 4 Wombat pillars
Sovereignty is more than a region.
Data residency is one input. Real sovereignty also depends on identity boundaries, key ownership, supplier concentration, portability and evidence. The Sovereign pillar turns those into controls a team can assess and improve.
Principle 2
Know who can reach it
Administrative access, support access, key custody and identity federation determine who can act on the data, regardless of where the rack sits.
Principle 3
Know how to leave
Portability, exit assistance, data export and contractual termination are part of sovereignty. If you cannot leave, you do not control the dependency.
Principle 4
Prove it
Sovereignty claims need evidence: control results, configuration checks, audit trails and a repeatable assessment that survives procurement and audit.
What to assess.
These are the signals the Sovereign pillar turns into controls. They are deliberately broader than data residency.
Data residency and jurisdiction
Encryption and key ownership
Identity and access boundaries
Exit strategy and portability
Supplier and supply-chain risk
Evidence and auditability
Pillars that carry the sovereignty story.
Sovereignty is not a single control. It is the interaction between residency, security, operations and portability.
WAF-SOV
Sovereign
The dedicated pillar for residency, jurisdiction, lock-in, exit and provider dependency.
Read the Sovereign pillar →WAF-SEC
Security
Identity, segmentation and cryptography decide who can reach the data.
Read the Security pillar →WAF-OPS
Operational Excellence
Exit plans, supplier oversight and evidence collection need an operating model.
Read the Operational Excellence pillar →WAF-REL
Reliability
Portability and recovery only help if the workload can actually run elsewhere.
Read the Reliability pillar →How to turn it into a plan.
A sovereignty review is only useful if it changes a renewal, an architecture decision or an evidence pack.
STEP 1
Map the data flows, backups, logs and the providers behind each service.
STEP 2
Score the Sovereign pillar together with Security and Operational Excellence.
STEP 3
Review exit, portability and key-ownership controls before the next renewal.
STEP 4
Export the evidence for procurement, audit and management reporting.
Sovereign pillar
Open →BSI C5 hub
Open →Comparison with provider frameworks
Open →Fintech compliance use case
Open →Trust center
Open →Controls catalogue
Open →Turn sovereignty into a score
Assess residency, access, exit and evidence in one baseline, then fix the gaps that matter for your jurisdiction and procurement.
Sovereignty is a technical and organisational assessment, not a legal opinion. Validate jurisdiction and contractual questions with your legal and procurement teams.