Digital sovereignty is about control.
Not simply where the servers are located.
A platform can be physically located in Canada while depending on foreign administration, management systems, software platforms, identity infrastructure, legal jurisdictions or strategic suppliers. Qvelo treats sovereignty as an architectural and operational property — something that can be identified, examined and explained.
Where do your dependencies actually sit?
Location tells you where infrastructure is.
Dependencies tell you who controls it.
External identity / IAM
Authentication, federation and directory services.
e.g. Azure AD, Okta
Foreign control plane
Management consoles, APIs and orchestration.
e.g. cloud provider control plane
Remote administration
Vendor and third-party access.
e.g. support, maintenance, contractors
Software licensing & updates
License servers, package repos and update infrastructure.
e.g. Microsoft, Red Hat, NVIDIA
Canadian AI / HPC environment
Physically located in CanadaTelemetry & monitoring
Logging, metrics and analytics.
e.g. Datadog, CloudWatch, Microsoft, third parties
Vendor support access
Support portals, remote diagnostics and escalation.
e.g. OEMs, cloud providers, ISVs
Jurisdiction / contractual exposure
Foreign laws, data access requests and contractual terms.
e.g. CLOUD Act, MLATs
Supply chain dependency
Hardware, firmware and components.
e.g. GPUs, servers, BMC/firmware
IN CANADA — PHYSICAL LOCATION ≠ OPERATIONAL CONTROL
Infrastructure can be in Canada. Dependencies can still be abroad.
From residency to effective control
The easiest sovereignty questions are geographic: where is the server, where is the data. The harder questions concern authority.
- Who possesses privileged access, and where is the management plane?
- Who controls authentication, and who controls encryption keys?
- Where does telemetry travel, and can a supplier disable the service?
- Could another jurisdiction compel action, or workloads be moved elsewhere?
- Can essential operations continue through a geopolitical or commercial disruption?
The abstraction problem
Modern technology works by hiding complexity. Applications hide platforms. Platforms hide orchestration. Orchestration hides infrastructure. Cloud services can hide nearly all of it.
Abstraction is extremely useful. But every hidden layer can contain dependencies. A Canadian-facing application may depend on foreign identity services. A Canadian data centre may rely on an external control plane. A locally hosted AI platform may still require foreign telemetry, licensing or administration.
Sovereignty requires following those dependencies through the stack.
Seven dimensions of digital sovereignty
No single dimension determines the outcome. The objective is to understand the complete control environment.
Data & provenance
Where is information created, processed, stored, replicated, backed up and removed? Who controls encryption and key management, and what may be exposed through telemetry, logging or support?
Infrastructure & compute
Who owns, operates and administers the underlying infrastructure? Can critical workloads continue operating if an external provider or connection is unavailable?
Control plane & software dependencies
The systems used to administer infrastructure, orchestrate workloads, manage identity, distribute updates and enforce licensing. The question is not whether every component is Canadian, it is whether a dependency creates an unacceptable loss of authority, visibility or continuity.
Access & auditability
Who can enter the environment, and who possesses privileged access? Can vendor and administrator actions be logged and reviewed? A system that cannot be meaningfully inspected is difficult to describe as fully under an organization's control.
Governance & policy
Who makes the rules, sets security policy, and can modify configuration or introduce mandatory dependencies? Sovereignty requires the authority to govern the system, not merely consume it.
Jurisdiction & legal exposure
Applicable jurisdictions, corporate structures, contractual obligations and potential mechanisms for compelled access. The purpose is to make that exposure visible, not to claim it is automatically unacceptable.
Ownership, continuity & strategic control
Can the organization change providers, migrate workloads, replace management systems or continue essential operations if a supplier disappears? Sovereignty is partly the ability to make a different choice tomorrow.
Sovereignty does not mean isolation
Canada cannot manufacture every processor, GPU, network switch or software component domestically, nor does sovereignty require that. Global technology supply chains will remain part of modern infrastructure. The objective is to identify which dependencies materially affect control — a foreign-manufactured GPU presents a very different sovereignty question from a mandatory foreign control plane.
Control matters more than labels.
Data, cloud and AI sovereignty
Related concepts, but distinct. The deeper the technology stack becomes, the less useful a simple residency statement becomes.
Data sovereignty
Concerns where information resides, which laws apply to it, and who can access or govern it.
Cloud sovereignty
Extends the analysis into infrastructure ownership, management systems, privileged access, orchestration, support and operational control.
AI sovereignty
Introduces additional questions involving compute capacity, training and inference infrastructure, models, data, frameworks and orchestration.
Sovereignty in procurement
An RFP may require that all data remain in Canada, and a bidder can satisfy that requirement while the architecture still contains foreign administration, remote support or control-plane dependencies, because those questions were never asked. Qvelo helps organizations move sovereignty upstream.
Sovereignty becomes an engineering requirement rather than a marketing statement.
There is no useful universal answer to “is foreign technology sovereign?” The better question is: what control have we delegated, to whom, under what conditions, and what happens if that relationship changes?