A region setting is residency, not sovereignty
The setting looks like sovereignty. You open the console, pick a European region, and your data now lives in Europe. What that setting controls is where the bytes rest. What it does not control is who can be ordered to produce them, and only the second question is about sovereignty.
The US CLOUD Act lets American authorities compel a US-based provider to hand over data it holds, wherever in the world that data sits. A European region does not place your files outside US jurisdiction if the company running the region answers to a US court. The lock is on the provider, not the postcode.
This stopped being theoretical this year. Washington cut off a foreign customer's access to a US AI provider, and the abstraction became an outage. For an owner the lesson is narrow and practical: a residency checkbox is a compliance artefact, not a guarantee that your operations keep running if the relationship between two governments changes.
What a control layer actually does
Valarian, a London company, raised $50 million in a Series A led by NEA this week, taking its total to $70 million. The product is not another cloud. It is a control layer, called ACRA, that sits on top of the cloud you already use and enforces the rules the console cannot.
Technically it runs above Kubernetes and behaves the same whether the workload is in a public cloud, in your own data centre, or on an air-gapped network. Each workload runs in its own sealed enclave with default-deny networking, short-lived secrets, and full audit logging. The customer holds the encryption keys, so the vendor has no access after deployment, and a compromised workload can be isolated, sealed, or revoked at runtime without taking down everything around it.
That last capability is the part a data-residency setting never gives you: a shutdown switch you control. The company sells two tracks, one for regulated enterprises and one for defence and government, but the architecture is the same. The claim is plain - sovereignty is not a feature you bolt on, it is where the keys and the kill-switch live.
Why US money is funding the escape hatch
The investor detail is the tell. This is NEA's first European defence and dual-use investment, which means a large American fund is now betting that European buyers will pay to depend less on American infrastructure. When the capital funding the escape hatch comes from the same country buyers are trying to route around, the demand is real.
The backdrop is money and mistrust. European defence spending reached about $447 billion last year, and public buyers are pulling back from US data platforms - the UK is unwinding a state Palantir contract, and Valarian's co-founder came out of Palantir to sell middleware rather than a platform. The bet is that the durable margin sits in the control layer between the customer and the hyperscaler, not in the applications on top.
For a European operator that reframes a familiar procurement question. The choice is no longer only which cloud, or even which region, but whether the layer that governs access, movement, and shutdown is one you own or one you rent. Vendors sell regions; sovereignty is decided one layer down.
The questions to ask before your next renewal
Treat the next cloud or AI renewal as the moment to test the difference between residency and control. Start with the keys: do you hold your own encryption keys, or does the provider hold them for you? If the provider holds them, the provider can be compelled to use them.
Then test the switch and the exit. Is there a kill-switch you can pull without the provider's cooperation? Does moving data out require your approval or the provider's? Can the same workload run unchanged in your own data centre or an air-gapped site if the hosted relationship ends? Each answer that depends on the provider is a point where sovereignty is a promise, not an architecture.
None of this requires abandoning AWS or Azure tomorrow, and Valarian's own design assumes you will keep using them. It requires knowing which guarantees you have written down and which you have merely assumed. The region setting was never the sovereignty control; the keys and the kill-switch always were.
Read next: The Grid, Not the Chips, Now Caps Britain's AI Buildout | Amazon Borrowed $25 Billion for AI Capacity
