Who owns the company, all the way up?
Follow the ownership to the top. The parent's law may reach data a local subsidiary holds. A companies register will usually tell you in a few minutes.
Why Village
What “sovereign” has to mean
“Sovereign cloud” is now a marketing term, so the word needs a test a reader can apply in an afternoon. Here are seven questions. A provider that answers all seven plainly, with evidence, is making a claim you can check. A provider that answers with a brochure is not.
Seven questions
Can a foreign law reach your data?
Under the US CLOUD Act (2018), a US provider can be required to produce data in its possession, custody or control, wherever it is stored. Keeping the servers in your own country does not change that by itself. A cloud that such a law can reach cannot be called sovereign.
Who holds the encryption keys?
If the provider holds the keys, the provider can be made to use them. If you hold them, a request has to come to you.
Where do the support staff work?
People with administrative access are reachable by the law of the country they work in. Ask where support and operations are staffed, not only where the servers are.
What happens under a foreign court order?
Ask for the written process. A good answer names who is told, when, and what the provider will and will not hand over.
Can you leave with your data intact?
The test is an export in an open format, with the records that let you check it. A platform you cannot leave is not yours.
Can an outsider check the claim?
Independent audit, published policies and records a third party can verify all count. A brochure does not.
The CLOUD Act, stated precisely
The Clarifying Lawful Overseas Use of Data Act was enacted in the United States in March 2018. Its operative section, 18 U.S.C. § 2713, says that a provider of electronic communication service or remote computing service:
“shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States.”
What that does imply
A provider subject to US law can be required by US legal process to produce data it holds, wherever the server stands. A data centre in Auckland or Frankfurt does not by itself put the data outside that reach if the company holding it is subject to US law. “Hosted locally” and “beyond the reach of US legal process” are two different claims, and only the first is proved by a server address.
What that does not imply
It does not mean every request is granted, that requests are common for community groups, or that any particular provider has handed anything over. It does not make a non-US company immune either: any company answers to the law of the countries where it is incorporated and where it operates. The test is the same in every direction: who owns the provider, which laws reach it, and who holds the keys.
Where Village is hosted
Village is hosted mainly by Catalyst Cloud in New Zealand and OVH in France. Our security page answers these seven questions for Village, and names the outside services, what each receives and where it sits.
Read our answers to the seven questions → Next: what the next wave complicates →
Sources
Every outside fact on this page rests on one of these sources.