Data embassies and sovereign dispersion

Rising geopolitical instability, cyber threats, and concentration risks associated with data localization are prompting governments to move beyond traditional sovereignty models centered on data residency and geopatriation. As a result, data embassies are emerging as a practical approach to ensuring continuity of government services and operations.

These legally protected enclaves enable a nation to host critical digital infrastructure on foreign soil while retaining full sovereignty and data control, and interest is being led by small, highly digitized states facing active conflict or severe hybrid threats, according to Daniel Nieto, senior director analyst, Gartner.

“Sovereign dispersion decouples legal authority from physical location, whereas multi-region cloud back-ups simply move data geographically while remaining entirely subject to the host nation’s courts, laws and warrants,” he says.

“A true data embassy is established through formal bilateral treaties that grant foreign-hosted server racks the same statutory diplomatic immunity and inviolability as a physical embassy. Practically, it maintains an active, low-latency ‘digital twin’ with automated rerouting, keeping core civic services running during a crisis, rather than sitting as a passive backup repository.”

During a ‘black sky’ event, such as total domestic infrastructure collapse from a cyberattack, power failure, or physical strike, automated network routing immediately redirects traffic to the extraterritorial node, explains Nieto.

“This ensures citizens can continuously access core registries, tax systems and central bank ledgers even if the physical capital is entirely compromised.”

The rise of the data embassy

Gartner predicts that at least 15% of nations in unstable regions will establish formal data embassy agreements by 2029. The world's first was established back in 2015 by Estonia, born out of an analogue workaround that saw diplomats transport hard drives of critical state data to Estonian embassies abroad.

“We thought, okay, we’re very much a digital state, so why are we doing this manually? Maybe there’s a better framework for that," says Allan Allmere, IT architecture and infrastructure advisor, Estonia’s Ministry of Justice and Digital Affairs.

That question led to the creation of its data embassy as a ‘last mile’ solution to ensure E-Estonia, the country’s digital backbone, would continue to run “if all else failed.”

Nothing like it had been attempted before, so it meant finding a country willing to even define what a ‘data embassy’ was. Estonia wanted to stay within Europe and found two countries genuinely open to the idea. “We settled on Luxembourg, partly because smaller countries are typically more flexible and agile, and partly because it had Tier IV rated data centers – the highest classification available, used by NATO.”

“Tier IV certification provides the fault tolerance and continuity that critical systems require, and is the same standard provided by the Government IT Center to their public administration clients,” adds a technical advisor at Luxembourg's government IT center.

“Hosting a partner state’s critical systems builds on that same foundation, with the addition of a dedicated environment and a specific bilateral legal framework.”

That legal framework rests on firmer ground than it might appear, as when it comes to international law, the consensus is that existing international rules apply, says Agnes Kasper, head of the Law Branch at NATO's Cooperative Cyber Defence Center of Excellence (CCDCOE). “There is no 'new law,' the question is rather how this vast existing law applies.”

She notes that the Vienna Conventions on diplomatic and consular relations – largely customary international law, binding even beyond their signatories – predate the cyber age and don't directly address arrangements like data embassies, "which is why it was necessary to write specific conditions into a separate intergovernmental contract."

Continuously evolving

Allmere treats Estonia’s data embassy project as a startup: “It's never done; it's always evolving.” There have been three steps so far, starting with storage of 10 critical datasets. This has since expanded, and step two was the addition of a live government cloud in Luxembourg, which was added this year. “This gives agencies an active site abroad rather than pure backup. Step three is still in development, but will be a long-term archival layer, built for recovery decades into the future, when current technology may be obsolete.”

Ministries are responsible for their own datasets, each preparing a full backup that will enable rebuilding, “keeping in mind that that might not be them,” notes Allmere. That backup is then encrypted and sent directly to Luxembourg over a private encrypted connection.

The data can be downloaded from the embassy at any time, but as a security measure, nothing can be altered or deleted and, to ensure readiness and resilience, each ministry must undertake a mandatory restoration test each year.

Data protection relies on multiple layers of security controls. At the state level, this hinges on a principle Nieto calls encryption as a border including encryption as a border (EaaB). “This is where data is fully encrypted using hardware security modules (HSMs), with keys retained strictly within the origin state – ensuring the host nation holds the hardware ‘lock,’ but only the home nation holds the ‘key.’

“For maximum security defense and intelligence workloads, this is bolstered by post-quantum cryptography, zero-trust architectures and physical air gaps.”

Enterprise takeaways

Estonia's approach may be a national-scale answer, but the same residency-versus-resilience question is now landing on enterprise IT leaders' desks, well before most of them are forced to make a similar call with their own data.

“Enterprise IT leaders must realize that physical data localization offers a false sense of security, as concentrating infrastructure locally creates an operational target. True resilience requires decoupling data location from operational control by maintaining strict encryption key sovereignty across dispersed locations,” says Nieto.

“Furthermore, enterprises should architect systems using containerized applications managed via Infrastructure as Code (IaC), allowing them to rapidly tear down and redeploy their entire digital stack to a neutral jurisdiction within hours if geopolitical or vendor risks escalate.”

While replicating the data embassy model would be considerably more difficult for private businesses, experts agree that many of the technical resilience principles are transferable.

“Without diplomatic machinery, a business can pilot a low-cost version of sovereign dispersion by decoupling its encryption keys from its cloud hosting provider. An enterprise can store encrypted secondary database replicas in a stable, foreign cloud region while retaining total control of the decryption keys in an on-premises or neutral third-party HSM,” says Nieto.

“Combining this with IaC allows the business to test asynchronous, containerized failovers to an isolated secondary jurisdiction without handing control over to a single vendor or host state.”

The underlying logic behind a data embassy still applies to businesses’ distributed continuity solutions, adds Allmere. “You need to make sure you don’t put all your eggs in one basket – don’t trust just one location, or even just one provider.”

He goes on to highlight the risk of cloud concentration. "Two or three years ago, I was in the camp of ‘let's put everything in the cloud, and it’ll be safe.’ Now I think that’s not so wise, because 71% of the whole cloud market in Europe is owned by just three US companies.

“You also need to consider how fast you can move from one cloud to another if needed. Feel free to use the big providers like Amazon, Microsoft, or Google, but I recommend avoiding their bespoke offerings, or you could become locked in,” he concludes.