Data Sovereignty

With the advent of SaaS, cloud and hosted services data sovereignty issues have become more prevalent. With the distributed architecture of the cloud, where application data resides may not be known to the end user. Cloud and SaaS providers may host data in technically efficient locations or locations that make the most commercial sense. Unfortunately, this location may well not be in the country of residence of the user. The distributed nature of the infrastructure driving these services means that the data hosted may fall under the laws of a foreign government.

Data Sovereignty Questions

Where is the data stored: Finding out where data is stored is not always obvious for the current generation of cloud and SaaS hosted services. Who makes the decision on the geographical location of your data? Does your service provider have a mandate to request your consent to move your data interstate or even internationally? Local laws: With distributed computing such as the cloud, data hosted by SaaS applications can land in weird and wonderful places. Whilst this may well keep the costs down, and make access fast, it leaves user's data vulnerable to foreign governments and their associated laws. Data privacy: Do local laws stipulate data retention mandates? When you move your data off the hosted service, is there a secure destruction policy? What security controls are in place to protect your data from malicious actors? Who owns your data: Organizations may not be aware of the ownership rights over data stored in different sovereign nations. Data that was protected by strong privacy laws, may not be protected in a foreign jurisdiction. This can make legal challenges to data access un-defendable. Offshore technical support: Many SaaS companies utilize offshore technical support centers. Support staff may have full access to sensitive data without your consent. This can lead to regulatory violations governing data privacy.

StratoKey can onshore sensitive data

StratoKey provides organizations with the capability to store locally (onshore) sensitive data. Data onshoring can be achieved by the StratoKey tokenization solution. This can be utilized with leading SaaS applications such as Salesforce, ServiceNow, SAP Business ByDesign, NetSuite and other cloud hosted applications. This data tokenization allows organizations to store their data in a database of their choice hosted on their own infrastructure.

Encryption is an alternative option that can be utilized to control access to sensitive data that is hosted offshore. Many SaaS companies utilize offshore technical support services. This can put sensitive data at risk and violate compliance requirements. By utilizing StratoKey encryption, your organization takes control of who can view the data in plain text. Offshore technical support services have no ability to decrypt your sensitive data without your express consent (provisioning in your StratoKey environment).

See our data sovereignty solutions for Salesforce, ServiceNow, SAP Business ByDesign & S/4HANA, NetSuite and other applications.