Why Encryption at Rest Is Not Enough Under the Cloud Act

Encryption at rest prevents unauthorized access to disks, but it does not prevent access through lawful requests to your provider.

If your cloud provider is subject to foreign law, regulators can still compel access to decrypted data inside the provider's environment.

That is the core Cloud Act risk for sensitive analytics datasets.

Hosting data in Paris does not mean it is governed by French law if the operator is headquartered elsewhere. Jurisdiction follows the provider, not the data center.

This is why sovereign analytics focuses on local providers with clear legal boundaries and independent key ownership.

• Use customer-managed keys and keep them outside the provider's control plane.
• Separate ingestion, relay, and storage so no single actor sees the full context.
• Limit retention windows to reduce exposure in audits.

[storage]
region = "eu-west"
provider = "sovereign"
key_management = "customer-managed"
[relay]
obfuscate_transport = true
rotate_session_hours = 24
[retention]
raw_events_days = 14
aggregates_days = 365

Pair this with a relay that strips transport identifiers and an analytics store that never sees personal data.