1 March 2026 · 10 min read · SpectraIQ Compliance
What 'sovereignty' actually means
Three layers: data residency (where bytes live at rest), data jurisdiction (which government can compel access), and operational access (who can touch the data day-to-day). All three matter.
The questions to ask
Where is data stored at rest? Where is it processed? Which subprocessors touch it? What is the legal basis for any cross-border flow? Who has production access and under what control?
Red flags
Vague answers about US 'regions'. No documented subprocessor list. No SOC 2 or ISO 27001. No ability to delete on request within a defined SLA.
The Australian default
AWS Asia Pacific (Sydney) for data at rest, AU-located processing, AU-domiciled support staff for any production access. This is the bar Australian dealerships should set.