The data sovereignty checklist for enterprise AI vendors

Data sovereignty has moved from a compliance footnote to a selection criterion. In 2026, BARC's Data Sovereignty survey of 320 companies found that 51% rate the topic as very important, up from 42% in 2025, and 76% expect its importance to keep rising (BARC, 2026).

Yet most AI vendor evaluations still start with a security questionnaire. Every vendor claims enterprise-grade security, and a questionnaire cannot show where prompts, documents, and embeddings actually travel. Five architecture questions can. Each one is answerable in a first vendor call, and together they settle the sovereignty question before the long-list stage.

Why certification checklists miss the point

Certifications matter, but they answer a different question. An attestation describes how well a vendor runs its own environment. Sovereignty asks something more basic: does the data enter the vendor's environment at all? When nothing leaves the buyer's infrastructure, most of the questionnaire evaluates a risk that no longer exists.

The market is shifting toward that architectural view. In BARC's 2026 survey, legal requirements remain the top external driver at 61%, but risk-driven motives are rising fast: political developments in the US now drive 54% of sovereignty initiatives, and concerns about public cloud dependency drive 46%. Repatriation initiatives doubled in a single year, from 8% to 16% (BARC, 2026).

Source: BARC, "Data Sovereignty 2026," survey of 320 companies, 2026

A contractual promise can be renegotiated, and a jurisdiction can change its rules. An architecture in which data never leaves the building is indifferent to both. That is why the five questions below examine data flows, not paperwork.

Five architecture questions that settle the evaluation

Each question below names the failure mode it catches and what a passing answer looks like. A genuinely on-premise platform passes all five; Lunnoa Automate was built to that bar, and its platform architecture is the worked example used for each pass.

1. Where does model inference run?

Prompts and documents travel to wherever the model executes. An API-based service with a "private" or "enterprise" tier still processes content on the vendor's hardware; the privacy is contractual, not physical. For sensitive workloads, that single fact decides the evaluation.

A passing answer places inference on infrastructure the buyer controls. Lunnoa deploys the full stack, including LLM inference, inside the client's own environment, so a document never crosses the network perimeter to be understood.

2. Where do embeddings and vector data live?

Embeddings are the data store most evaluations forget. Any platform doing retrieval or semantic search converts documents into vector representations, and those vectors are derived directly from the content itself. They deserve the same protection as the documents, yet many checklists never ask where the vector database runs.

A passing answer keeps vector storage in-perimeter. Lunnoa ships its vector database inside the platform deployment, so embeddings live under the same roof, and the same access controls, as the source documents.

3. Who holds the encryption keys?

Key custody is where sovereignty becomes measurable, and the market is voting with its infrastructure. In 2026, the valantic and Handelsblatt Research Institute study of 1,000 DACH decision-makers found 28.3% have already implemented their own key management and another 36.5% are in implementation (valantic, 2026).

Source: valantic / Handelsblatt Research Institute, survey of 1,000 DACH decision-makers, 2026

Vendor-managed keys reduce custody to a promise: the provider commits not to use access it technically retains. A passing answer keeps keys under the client's own custody. In Lunnoa's architecture, encryption keys stay inside the client's environment, so there is no third party whose restraint has to be trusted or audited.

4. Where do audit logs live, and who can read them?

Logs of AI activity are sensitive data in their own right. They record prompts, document names, decisions, and errors, which is often exactly the material the platform was supposed to protect. If those logs stream to a vendor's cloud for "support purposes," a second copy of sensitive activity now exists outside the perimeter.

A passing answer writes and retains audit trails in-perimeter, readable by the client's own compliance team without vendor involvement. Lunnoa's audit logging and governance controls are part of the deployment itself, so a review never depends on an external ticket.

5. What leaves the network during normal operation?

The last question catches everything the first four did not: telemetry, usage analytics, "anonymized" quality feedback, license checks. Unsanctioned egress is precisely how shadow AI became a governance problem, and a sanctioned platform should be held to the stricter standard, not exempted from it.

A passing vendor can enumerate every outbound connection and confirm that none carries business data. Lunnoa's platform operates fully inside the client's network. There is also a structural reason for that: metered, per-execution pricing requires usage reporting to bill against, while Lunnoa's flat licence has nothing to meter, so nothing about usage needs to leave.

What a passing evaluation looks like in practice

The five questions work best before the RFP long-list, not after. Asked early, they eliminate most of the field in one pass and spare both sides a questionnaire cycle. The direction of travel supports asking them plainly: in 2026, 90% of DACH decision-makers report they are already acting on, or planning, measures to strengthen digital independence (valantic, 2026).

For the vendor that passes, the security review changes character. There is no data transfer to assess, no sub-processor chain to map, and no external log store to inspect, so the review becomes verification rather than negotiation. That is what self-hosted AI agents mean for compliance teams in practice: fewer open questions, answered by architecture.

One trade-off deserves honesty. Running software in-perimeter shifts operational responsibility, including patching, capacity, and backups, to the buyer. Teams without spare infrastructure capacity do not have to absorb that: with Managed Deployment, Lunnoa stands up and operates the platform on the client's infrastructure, while data, keys, and logs stay in the client's environment.

The bottom line

A data sovereignty evaluation does not need forty questions. It needs five, all architectural: where inference runs, where embeddings live, who holds the keys, where logs are written, and what leaves the network. Vendors that pass can show it in an afternoon. Lunnoa Automate answers all five inside the client's own infrastructure, which is exactly where those answers belong.