Achieving Data Sovereignty in the Cloud: Three Approaches to Key Control

Cloud adoption gives organizations the flexibility and scalability they need to innovate. But as more sensitive data moves into cloud environments, one question becomes increasingly important: who ultimately controls access to that data?

This is the heart of data sovereignty.

Data sovereignty is the ability of an organization to maintain control over its data and how it can be accessed, regardless of where that data is stored or processed. It goes beyond data residency. Storing data in a specific country addresses where the data sits; sovereignty addresses who has control over the data and the keys protecting it.

For many organizations, achieving greater data sovereignty has become a strategic priority. Regulatory requirements, growing cyber threats, third-party access risks and increasing concerns around cross-border data access are driving businesses to reduce dependency on cloud-provider-controlled security mechanisms.

Encryption is only as sovereign as the keys

Encryption protects data from unauthorized access, but encryption alone does not determine who ultimately controls that access. That control comes from the encryption keys.

By separating key management from the cloud environment, organizations can retain greater authority over how sensitive data is protected — including key generation, storage, rotation, revocation and destruction.

Three approaches offer different levels of control: HYOK, DKE/CSE BYOK 

HYOK: Hold Your Own Key

Hold Your Own Key provides the highest degree of separation. Encryption keys remain entirely outside the cloud environment, with key protection, wrapping, unwrapping and lifecycle management handled externally.

The cloud provider therefore remains outside the trust chain and cannot independently decrypt the protected data. This model is particularly suited to organizations with stringent sovereignty, security or compliance requirements.

Double Key Encryption / Client-Side Encryption

Microsoft’s Double Key Encryption (DKE) or Google’s Client-Side Encryption (CSE) approaches to securing data in cloud. It uses two keys to protect data; one key is in client [MG3.1]control [MG4.1]and a second key is securely stored in Microsoft Azure.

Therefore, DKE adds another layer of separation. Data is protected using two keys, with one key on client side managed externally. The encryption and decryption is performed on the endpoint device and user data such as emails or documents is encrypted before it reaches the cloud.  

Because the second key remains [MG5.1]under the organization's control, access to protected data can be restricted or revoked through the external key-management environment. This creates a stronger separation between the cloud environment and the organization’s encryption controls. Organizations using key management solutions can fully own the keys and manage their lifecycle.  

BYOK: Bring Your Own Key

Bring Your Own Key enables organizations to maintain control over a customer-managed key while using it to protect encryption keys within the cloud environment.

The key lifecycle remains under external management, giving organizations greater visibility and control over their cryptographic assets. BYOK can provide a practical foundation for organizations looking to strengthen key ownership without fundamentally changing their cloud operating model.

Turning key control into operational sovereignty

Managing these capabilities requires more than simply storing keys outside the cloud. Organizations need secure key generation, comprehensive lifecycle management, auditability and reliable integration across cloud and on-premises environments.

Utimaco Enterprise Key Manager as a Service (EKMaaS) provides this foundation as a fully managed external key-management service. It combines centralized lifecycle management with HSM-backed key protection, enabling organizations to maintain control over their cryptographic assets without taking on the operational burden of managing dedicated infrastructure.

Ultimately, data sovereignty is not simply about where data resides. It is about who holds the power to protect, access and revoke that data. By choosing the right key-control approach and keeping critical cryptographic assets under their own authority, organizations can build a cloud security model that is more controlled, auditable and sovereign.

About the Author

Peter Czempas

Product Marketing Manager, Utimaco