Data residency + sovereignty for AI ITSM (May 2026)
Source report: /tmp/data-residency-sovereignty-2026-05-12.md (305 lines, ~37KB).
Atomicwork hosting correction (material wiki update)
The May 12 2026 research pass surfaced that Atomicwork’s public security page references AWS RDS encryption on the data plane, contradicting the wiki’s prior framing of “Azure AI Foundry hosting” as the whole stack.
- Likely reality: Azure for AI / model inference + AWS RDS for tenant data plane.
- This partly weakens the “must mirror Atomicwork’s Microsoft co-sell” thesis (channel-partnership-roadmap-2026).
- Wiki entity updated May 12 2026.
Sovereign cloud GA status (verified May 2026)
| Sovereign cloud | Status | Date |
|---|---|---|
| AWS European Sovereign Cloud | GA | Jan 15, 2026 (Brandenburg) |
| S3NS PREMI3NS | SecNumCloud 3.2 qualified | Dec 17, 2025 |
| Bleu | Commercially launched | Targeting SecNumCloud 3.2 |
| Microsoft Sovereign Public Cloud | GA | M365 Local connected Dec 2025 / disconnected early 2026 |
| Atlassian Isolated Cloud | Early Access | Sept 2025; GA window Mar-Oct 2026 (status uncertain May 11) |
| FedRAMP 20x Phase 2 (Moderate) | Concludes March 2026 | Phase 3 public adoption Q3-Q4 2026 |
Regulatory landscape (residency delta)
This page is the residency delta on top of ai-itsm-compliance-roadmap-2026 + asia-pacific-ai-itsm-2026 — it does not re-derive the broader regulatory landscape.
India
- DPDP Act in force Nov 13, 2025.
- Negative-list model — no countries on the list as of May 2026.
- US-hosted is legally permitted for Indian DPDP-scope customers.
- Data-residency is procurement-preferred, NOT legally required.
EU
- AWS European Sovereign Cloud (Brandenburg) Jan 15, 2026 = first hyperscaler sovereign offering.
- S3NS + Bleu = SecNumCloud 3.2-qualified by Dec 2025.
- Microsoft Sovereign Public Cloud + M365 Local available.
US
- FedRAMP 20x Phase 2 (Moderate) concludes March 2026.
- Phase 3 public adoption Q3-Q4 2026.
Vendor posture comparison (Tier A)
| Vendor | Public residency posture | Status |
|---|---|---|
| Atomicwork | Region-specific options; ISO 27018/27701 | ✅ Verifiable |
| Serval | 3 real deployment models (Cloud SaaS / Hybrid / Self-Managed K8s) | ✅ Verifiable |
| Console | No public posture | ❓ |
| Edra | No public posture | ❓ |
| STLabs | No public posture | ❓ Pre-launch |
| Treeline | No public posture | ❓ |
| Risotto | No public posture | ❓ |
| Ravenna | No public posture | ❓ |
| Echelon | No public posture | ❓ |
Posture is bifurcated: Only Atomicwork + Serval (2 of 9 Tier-A competitors) have verifiable public residency stories as of May 2026.
Notes
- BYOK is unanimous whitespace across the competitor set — see multi-tenancy-isolation-2026.
Open follow-ups
- Atomicwork hosting split needs further triangulation (Azure-only vs Azure+AWS) before competitive-positioning slides reference it.
- Atlassian Isolated Cloud GA status as of May-Oct 2026 — watch announcements.
- FedRAMP 20x Phase 3 public adoption Q3-Q4 2026 — re-evaluate FedRAMP timing if any govt-ARR pipeline emerges.
Related
- ai-itsm-compliance-roadmap-2026 — broader compliance landscape
- asia-pacific-ai-itsm-2026 — India DPDP + APAC regimes
- multi-tenancy-isolation-2026 — BYOK whitespace + partition-key design
- hyperscaler-agent-platforms-2026 — Azure-primary thesis
- channel-partnership-roadmap-2026 — Microsoft co-sell context (Atomicwork hosting correction adjusts thesis)
- atomicwork · serval · microsoft · aws
- Init Intelligence