Sovereignty: a marketing word, or a technical property?
"Sovereign" now appears on almost every brochure. The term deserves an operational definition, otherwise it means nothing. For a network management tool, one question settles it: where are your configurations processed, and who can be compelled to hand them over?
Everything else — the vendor's nationality, the hosting location, the certifications — either follows from that question or fails to answer it.
What a network configuration really contains
The sensitivity of this data is underestimated because it does not look like business data. Yet a firewall or router configuration describes:
- the addressing plan and the full segmentation of the network;
- the permitted flows, and therefore the dependencies between applications;
- the exposed services and software versions in place, and therefore the applicable vulnerabilities;
- sometimes password hashes and keys;
- the interconnection points with partners and remote sites.
In other words: a complete attack plan for the organisation. Few teams would email that document to a third party; many copy it continuously into a hosted service.
Three questions to ask any tool
Where is the data processed?
Not "where is it stored", but "where is it processed". Storage in Europe with a control plane administered elsewhere still exposes the content. The useful answer is where the software executes.
Which law applies to the operator?
A company under a foreign jurisdiction can be compelled to produce data it holds, regardless of where the server sits. That is a legal constraint, not a technical flaw: no provider-side encryption removes it if the provider also holds the keys.
What happens if the service disappears?
If your management plane depends on an external service, an outage does not only cost you an interface: it costs you your configuration history at the moment you need it most. Reversibility is also an availability question.
What running it on your own infrastructure changes
Installing the tool inside your network does not magically make the data safe: you inherit the duty to protect it. But it removes an entire class of problems. There is no external copy to audit, to list in your processing register, to repatriate at the end of a contract, or to defend against foreign legal access. What was never copied does not have to be defended.
The secondary benefit is often the most tangible day to day: a tool that needs no outbound access can run inside an isolated industrial network, a classified site, or an enclave with no default route. That is exactly where hosted platforms force you to shrink the scope instead.
Sovereign does not mean national
One frequent confusion is worth clearing up: sovereignty is about control, not about the customer's geography. A French publisher whose software installs on the customer's premises serves an organisation based elsewhere just as well — it then runs the product under the law that applies to it, in its own country. The model is the same everywhere; what changes is where it executes, and that always belongs to the customer.
Our sovereign network management page details this deployment model, and the air-gapped environments page covers the extreme case: no outbound access at all.
