Digital sovereignty in document infrastructure: what it means and why it matters
“EU hosted” is not the same as “EU sovereign.” This distinction is the source of most compliance problems organizations discover when it is too late: after a data transfer impact assessment, after a regulatory inquiry, or after a vendor changes its terms.
For documents that carry legal weight, the question of sovereignty is not academic. It determines whether your organization controls its own evidence, or whether that control is delegated to a vendor under terms that can change.
What sovereignty means for document infrastructure
Sovereignty over document infrastructure means:
Data residency: documents are stored on infrastructure physically located in a jurisdiction where the applicable data protection law applies, and no copy is held or processed outside that jurisdiction without explicit consent.
Access control without vendor exceptions: the vendor cannot access your documents except under the terms you explicitly agreed to. This excludes vendor maintenance access, law enforcement requests under foreign law, and access by parent companies in other jurisdictions.
Evidence portability: you can export all your documents, audit trails, timestamps, and evidence packs in a format that is verifiable without the vendor’s participation. If the vendor shuts down tomorrow, your evidence remains valid.
No foreign jurisdiction exposure: the vendor is not subject to laws that compel disclosure to foreign governments or agencies, such as the US CLOUD Act or equivalent legislation in other jurisdictions.
Why “EU hosted” is not sufficient
A cloud service can host data in EU datacenters while still being subject to non-EU jurisdiction. If the operating company is incorporated in the United States, its parent is US-based, or it is subject to US law through other means, it may be compelled under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) to produce data stored in EU facilities to US law enforcement, without the knowledge or consent of the data subject.
The Court of Justice of the EU (CJEU) invalidated the EU-US Privacy Shield in 2020 (Schrems II) precisely because US surveillance law makes adequate protection impossible for personal data transferred to or accessible by US-controlled entities. The subsequent EU-US Data Privacy Framework has been in legal uncertainty since its adoption.
For documents containing personal data (which includes invoices, HR records, contracts, and medical documents), a vendor subject to US jurisdiction that stores data in EU datacenters is not a sovereign solution. The data residency is EU; the legal exposure is not.
The vendor lock-in problem specific to document evidence
Most document platforms create lock-in that is invisible until you try to leave. For documents without legal weight, this is an inconvenience. For documents that serve as legal evidence, it is a structural risk.
The specific lock-in mechanisms to watch for:
Proprietary audit trail formats: if the vendor’s audit trail is not exportable in a verifiable format, your chain of custody depends on the vendor’s system being operational and their API remaining accessible. If the vendor is acquired, shuts down, or changes their API, your chain of custody may become unverifiable.
Timestamps from vendor-controlled authorities: if the RFC 3161 timestamps on your documents are issued by a TSA operated by the vendor, verifying those timestamps after the vendor relationship ends requires the vendor’s continued cooperation. This is a contradiction: the timestamp is supposed to be independently verifiable.
Opaque validation records: if the validation reports in your evidence pack are human-readable HTML rather than machine-parseable structured data, a future auditor may not be able to reproduce the validation without re-running it, which tells them nothing about whether the document was valid at archiving time.
The test for genuine sovereignty: can you take your documents and evidence packs to a technically competent third party who has never interacted with your vendor, and have them verify the integrity and provenance of every document, using only open standards and public-key infrastructure?
If the answer is no, your evidence infrastructure is not sovereign.
GDPR and document retention obligations
GDPR creates specific tensions with long-term document retention. Article 5(1)(e) requires data minimization: personal data should not be kept longer than necessary. Article 17 establishes the right to erasure. But national tax laws require retaining invoices (which contain personal data) for seven to ten years.
The resolution is the retention exception in GDPR Article 17(3)(b): erasure obligations do not apply where processing is necessary for compliance with a legal obligation. Invoice retention under GoBD, the French fiscal code, or Belgian VAT law qualifies.
The practical implication for sovereignty: you must be able to demonstrate, for each retained document, that the retention is covered by a specific legal obligation, and that the retention period and scope are no broader than that obligation requires. This is a documentation and audit trail requirement, not just a storage requirement.
What sovereign document infrastructure looks like
A sovereign document infrastructure meets these criteria:
- Operated by an entity incorporated and operating exclusively within a jurisdiction with adequate data protection (EU member states meet this bar for EU data)
- No parent company, investment structure, or contractual arrangement that creates exposure to non-EU jurisdiction
- Evidence packs exportable in open, verifiable formats (PDF/A-3, CMS timestamp tokens, JSON audit trails)
- RFC 3161 timestamps from TSAs listed on the EU Trusted List, not vendor-operated TSAs
- Hash chains verifiable with open-source tooling without vendor participation
- Self-hostable option for organizations that require complete infrastructure control
Point 6 is particularly relevant for government bodies, regulated financial institutions, and critical infrastructure operators, which may have requirements that preclude use of any third-party hosted service regardless of jurisdiction.
SealDoc and EU sovereignty
SealDoc operates exclusively on EU-based infrastructure under EU jurisdiction. There is no parent company relationship that creates foreign jurisdiction exposure.
Evidence packs produced by SealDoc are independently verifiable: RFC 3161 timestamps from EU Trusted List TSAs, hash chains verifiable with SHA-256, and audit trails exported as structured JSON. Verification requires no API call to SealDoc and no continued relationship with SealDoc.
For organizations that require on-premises or private-cloud deployment, SealDoc supports self-hosted deployment on your own infrastructure. The evidence format is identical to the hosted version, so migrating from hosted to self-hosted or back does not affect the verifiability of previously issued evidence packs.
The underlying principle is that the evidence should outlast any particular vendor relationship. If SealDoc no longer exists in 2038, every evidence pack issued today should still be verifiable by an auditor with a SHA-256 implementation and the TSA’s public certificate.