{"page":"/blog/eu-sovereign-ad-tech-stack","modified":"2026-10-18","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Question","Term","What answers it","Typical evidence"],"rows":[["Where are the bytes?","Data residency","Region selection, data-at-rest location, backup location","Region name, provider data-location commitment"],["Which laws can compel access?","Legal (jurisdictional) sovereignty","Who controls the provider, where its parent is incorporated, which treaties apply","Corporate structure, CLOUD Act exposure, EU e-Evidence exposure"],["Who can log in?","Operational sovereignty","Residency and employer of staff with privileged access, support escalation path","Access policies, EU-only on-call rosters, audit logs"],["Who holds the keys?","Technical sovereignty","Encryption with keys the provider cannot read; external or on-premise key management","External key manager, HSM ownership, key access justifications"],["Can we leave?","Portability","Open formats, export tools, switching charges","Data Act Article 29 compliance, exit plan"]],"sourceUrls":[[],[],[],[],[]]}