Oasis Stack Oasis Stack A CloudHost Initiative
EN
Talk to us
A cloud module stack on a plinth inside a glowing boundary ring with gate posts; outside conduits stop at the gates
Residency is one question.
Sovereignty is seven.
Architecture · Security & sovereignty

Sovereignty beyond
data residency.

Residency answers one question. Six more decide whether a cloud is genuinely sovereign: infrastructure, operations, identity, security, governance and technology.

Talk to us Oasis Sovereign Cloud
Seven layersDecided, not assumed
Seven questionsResidency is one of them
Decided, not assumedLayer by layer, explicitly
Your boundaryKeys and custody stay inside it
The seven layers

Decide each one, deliberately.

For every layer there are three honest answers: held locally, shared under agreement, or delegated. The platform makes the choice explicit, and enforces it wherever software can.

  1. 01
    Data
    Where data is stored, processed and backed up, and who may ever read it.
  2. 02
    Infrastructure
    The racks, the site and the hardware the cloud runs on.
  3. 03
    Operations
    Who runs the platform day to day, under whose employment and whose law.
  4. 04
    Identity
    Whose directory issues credentials, and where authentication decisions are made.
  5. 05
    Security
    Key custody, encryption, monitoring and incident response.
  6. 06
    Governance
    The policies enforced across every service, and the evidence they produce.
  7. 07
    Technology
    The right to run, inspect and continue the platform without a foreign dependency.
The test

Three questions per layer.

A sovereignty claim is only as strong as the answers to these, layer by layer. They are the questions our own architects ask before a deployment is designed.

Oasis Sovereign Cloud
Who holds it?
Which organisation, under which jurisdiction, holds this layer today.
Who can change it?
Who can alter the arrangement, and what notice you would receive.
What happens if the relationship ends?
Whether the cloud keeps running, and on whose terms.
Interoperability

Sovereign does not mean isolated.

A sovereign cloud can still participate in the ecosystem — by agreement, with the boundary enforced by the platform rather than promised in a contract.

Elsewhere
Isolation
Total separation is simple to explain and expensive to run: no partner services, no shared capacity, no marketplace.
Elsewhere
Open participation
Connecting to a foreign platform hands back several of the layers you just secured.
With Oasis Stack
Governed federation
Publish and consume specific services under an agreement you control, while data, customers and operations stay home.
How each layer is verified

A claim you can test, layer by layer.

Sovereignty is asserted far more often than it is demonstrated. For each layer, this is what a reviewer should ask to see — and what the honest answer looks like.

Data
Ask to see
The residency policy as configured, and an audit record showing an attempted out-of-region provision being refused. A policy that has never refused anything has not been tested.
Infrastructure
Ask to see
The site, the ownership of the hardware, and who holds physical access. A contract naming a country is not the same as a rack you can walk to.
Operations
Ask to see
The employment jurisdiction of the people with production access, and the escalation path when they are unavailable.
Identity
Ask to see
Where authentication decisions are evaluated, and whether any of them traverse a network you do not control.
Security
Ask to see
Key custody: who can decrypt, under whose authority, and what happens to that authority if the supplier relationship ends.
Governance
Ask to see
A policy, the provisioning decisions it governed, and the evidence produced — all three, for the same control, on the same day.
Technology
Ask to see
The continuity position: what you may run, inspect and continue operating if the vendor relationship stops. With Oasis Stack, your infrastructure is deployed first and stays yours, the platform stack is open and published, and the exit from CloudHost-built products is planned with you. Every control on this page is a platform capability, configured at deployment to your programme’s rules, design and permissions.

The trade in each choice: holding a layer locally costs capability or cost or both — local operations means a smaller on-call pool, in-country key custody means you carry the key-management burden, technology sovereignty means a slower path to new features. A sovereignty programme that has not named those costs has not finished the design.

Who builds what

Built in-house. Extended with alliances.

Sovereignty is decided by you, and enforced by the platform wherever software can enforce it. The infrastructure it runs on is chosen by you.

Built in-house
  • The seven layers made explicit, and enforced as policy wherever software can enforce them
  • Key custody, residency and movement rules as platform policy
  • Workloads that keep running without a connection to CloudHost
Built with alliances
  • In-country infrastructure from the vendors you choose, with no lock-in to any infrastructure vendor
  • HSM-backed key custody through OpenBao, and identity providers held in your jurisdiction
How alliances join
Your data. Your operations. Your jurisdiction.

Test your sovereignty claim.

Walk the seven layers against your programme and see which ones are genuinely held locally.

Talk to us Oasis Sovereign Cloud