Sovereignty is the easy part to put on a marketing page. The hard part is the operations underneath: the bare-metal orchestration, the failover topology that actually fails over, the CVE response that doesn't take three sprints, the monitoring that catches the right things at three in the morning. These are working notes on how I think about that work at Petrichor Labs, where every shortcut I might have taken in a hyperscaler has to be replaced with something I built.
Most "sovereign" offerings outsource hard problems back to the same jurisdictions they claim to leave. Managed load balancing, managed DNS, managed observability: each one is a quiet re-import of the dependency the customer thought they were escaping. The interesting work is what survives that constraint, and it clusters into four disciplines.
Tenant isolation is a network property, not a promise. On bare metal, the tool that earns its keep is the private mesh: encrypted overlay networking where each tenant's workloads see a flat private network and see nothing else, regardless of which physical hosts they land on. The property that matters is that isolation is enforced by cryptographic identity (a peer either holds a key that belongs in the mesh or it does not exist) rather than by firewall rules that are one fat-fingered change away from being wrong. Rules drift; membership doesn't. It also makes the sovereignty story literal: the traffic between two of a tenant's services never transits anything, anywhere, in plaintext, including our own switches.
Failover you haven't executed is failover you don't have. The topology work (where the standby lives, what replicates synchronously versus asynchronously, what promotes and how) is design-review material, but the operational discipline is simpler and harder: the plan is only as real as the last time it ran. A failover that has never been exercised against production-shaped load is theatre, and the difference between theatre and infrastructure shows up precisely once, at the worst available moment. So the standing question for every high-availability claim is blunt: when did this last actually happen, and who watched it?
CVE response on a small team is a triage discipline, not a heroic one. You cannot patch everything the moment it's published and also ship anything, so the honest posture is a short, fast pipeline: is the affected component internet-facing, is the vulnerability reachable in our configuration, is there active exploitation. Everything that doesn't trip those wires gets a default cadence. The trap on a tight team is treating every advisory as an interrupt; the opposite trap is a monthly batch that leaves a reachable RCE open for three weeks. The discipline is knowing, ahead of time, which class an advisory belongs to.
Monitoring you'd trust at 3am is mostly monitoring you deleted. The pager earns trust by being right, and it's right when every page maps to a condition that requires a human now. Everything else (the interesting-but-not-urgent, the trends, the capacity slopes) belongs in dashboards consulted during daylight. On bare metal the temptation is to alert on hardware minutiae because you finally can; the correction is to alert on what the tenant would feel, and let the cause-hunting happen after the page, not inside it.
None of this is glamorous, which is rather the point. The claim "your data never leaves this jurisdiction" is one sentence of marketing and several years of unglamorous verbs: replicating, patching, failing over, watching. Sovereignty that's real is sovereignty someone operates. The rest is a flag on a landing page.