Digital sovereignty is a dial, not a switch

“We’re digitally sovereign — our data sits in a Swiss data centre.” I hear that sentence a lot. It isn’t an answer. It’s an address.

Digital sovereignty is turning into a label: a flag in the imprint, a checkbox in a tender, a sales argument. This Sunday Edition turns it back into something you can verify — with one question, five levels and a self-test that counts in days instead of feelings.

The trigger was a question I was asked this week, an honest and a good one: if I buy my hardware in the US, am I still digitally sovereign? The answer is further down, and it goes: it depends on whether the thing keeps running once the seller stops liking you.

The wrong question: where does it come from?

Origin is convenient. It’s visible, it’s in the imprint, you can write it into a tender and tick it off. It just doesn’t answer the question that matters.

A supplier in your own canton can suspend your account, triple its prices, be sold, go bankrupt or terminate your contract because the product line is being discontinued. None of that gets better because the invoice arrives in francs. And reach on a domestic portal is just as rented as reach on an American platform — more predictable perhaps, contractually cleaner, but not yours.

Conversely, a graphics card from California sitting in your own rack still obeys you even if you and the manufacturer never exchange another word.

That doesn’t make origin irrelevant. Where data sits co-determines which law applies and which authority can demand what access; with personal data that’s a data-protection question and deserves a clean answer. But it’s the second question. The first one is different.

The right question: what does leaving cost you?

Sovereignty is not a question of origin, it’s a question of exit. It splits in two:

1. Can someone else switch it off remotely?
2. If you wanted to move tomorrow — what would it cost you in days, in francs, in lost history?

Whoever can answer both is sovereign enough to negotiate. Whoever can’t doesn’t have a contract, they have a dependency — regardless of the country it was signed in.

And because this is a cost question, sovereignty is never a switch set to “yes” or “no”. It’s a dial. You can turn it up to different points in different parts of your operation — and you should know where it stands everywhere.

The dial has five levels

Hardly any company sits at the same height everywhere. Which is exactly why it pays to walk through the five levels one by one instead of saying “we’re in the cloud” and leaving it there.

1. Data — is there a copy outside that you can read?

The bottom level, and the one most people fail without noticing. Not “is there an export button”, but: have you run the export, does it live outside the provider, and have you ever opened it? A folder full of files only the provider’s software can read isn’t a backup, it’s a sedative.

Test question: show me the latest export of your most important system — and open it.

2. Identity — do you own your address?

Your mail address, your login name, your profile handle: that’s where other people find you. If that address ends on a provider’s domain, it belongs to the provider. They can suspend it, and everything attached to it goes with it — password resets included.

For us, our own domain is the username on the open networks; if a platform throws us out, we move and keep the address. It’s the cheapest sovereignty you can buy, and it costs twelve francs a year.

Test question: how many of your accounts can you recover if you lose your account at exactly one provider?

3. Relationships — are your contacts rented or owned?

This week a Swiss marketing lead described publicly how three years of brand building vanished in a day: the platform account was suspended without warning and without a reason. Four hundred posts, tens of thousands of francs in ad spend, a verification badge — none of it helped.

The line doesn’t run between domestic and foreign, it runs between rented and owned. Followers are rented. A consented list, your own website, your own feed are owned. Both are legitimate — the rented part just must not be the only connection to your customers.

Test question: if your best channel disappears tomorrow, how do you reach your customers the same afternoon?

4. Operations — who can flip the switch?

This is where it gets uncomfortably concrete: cloud accounts, licence servers, remote-maintenance access, subscription features that go dark when the contract ends. Every one of those leashes is a hand on a switch that isn’t yours. It can also be pulled by accident — an automated abuse detector needs no ill will, just a false positive.

Test question: what in your operation stops if your biggest provider locks you out for fourteen days?

5. Process — could anyone but you run it?

The quietest level. If your process is stuck in a proprietary format that exactly one piece of software understands, you no longer have a choice, you have a habit. Open formats, documented procedures, data in text form: that’s the insurance against still having everything in five years and being able to read none of it.

Test question: could a different provider take over your most important process without someone reinventing it?

And now the hardware question

Back to the opening. A graphics card, a server, a laptop from the US: that’s trade dependency, not a loss of sovereignty.

The difference fits in one test: does it keep running without anyone else’s consent? The purchased machine keeps computing when the relationship with the seller breaks, when the exchange rate turns, when the next delivery takes a year. What you bought is a procurement risk — real, plannable, softened with spare parts and a second supplier. The same compute rented as a cloud instance is something else entirely: a dependency somebody else can end mid-operation.

There is one exception, and it’s spreading: hardware on a leash. Devices that refuse service without a licence server, whose management runs only through the manufacturer’s portal, whose features live in a subscription or whose firmware has to phone home regularly. That’s not buying a device, that’s a subscription with sheet metal around it — and it drops straight to level 4.

The question before every purchase: does this thing work completely if I pull the internet cable and the manufacturer disappears tomorrow?

So buy anywhere. Just don’t be dependent anywhere.

The self-test that counts in days

Take your biggest provider — the one holding the most. Then answer a single question honestly:

They suspend you tomorrow morning. How many days pass before you’re working again?

• Under 3 days: the dial is up. You have a copy, an address and a plan.
• 3 to 30 days: the normal state. You’re not at anyone’s mercy, but moving hurts. Work on the level that costs the most days.
• Over 30 days: that’s not a dial any more, that’s a switch — and it’s in someone else’s hand.

The number is uncomfortable, but it’s negotiable. And it’s the only metric on this topic you can explain to a board in one sentence.

Where we aren’t at the top ourselves

A text about sovereignty that only explains how sovereign its author is would be a sermon. So here’s our own list, with the exit question answered:

• The metal isn’t ours. Our servers are rented, in other people’s data centres. The dial deliberately isn’t at the top — in exchange, the configuration is fully described as code, the data sits encrypted in a second location, and moving a complete machine elsewhere isn’t a thought experiment: we did it this month.
• The domains sit with a large foreign registrar. That’s our weakest spot, because level 2 sits underneath everything else. Mitigations so far: transfer lock, our own control over the DNS records, a plan B. A move is open and on the list — the dial is lower here than I’d like.
• This text also appears on a platform that can suspend me tomorrow. Deliberately. Rented reach is allowed as long as the original lives on our own site and our own feed carries it.
• Part of the AI work runs in someone else’s cloud. The line is technical, not ideological: anything touching customer or personal data runs on the model on our own machine. The rest runs where it’s better today. The dial moves up as soon as the local models catch up — and they’re catching up fast.

Four honest entries, four known exit prices. That’s the difference between a dependency and a decision.

Three decisions that move the dial this week

1. One export per system — and open it once. What won’t open doesn’t count.
2. Your own domain as your address everywhere. Mail, logins, profiles. Twelve francs a year against the most expensive single point of failure there is.
3. One line per new purchase: how do I get out of this, and what does it cost in days? Before signing, not after.

Sovereignty isn’t the state in which you own everything. Nobody can pay for that, and it wouldn’t be good business either. Sovereignty is the state in which you know what leaving costs you — and in which that number is small enough that you can stay because you want to, not because you have to.

So: take your biggest provider. How many days is it for you?