If vLLM already solved LLM serving, why did SGLang appear?
It is quite common to think that Sovereign AI is just about where your data lives. However, true sovereignty is about having control over your digital world, not just a local storage spot. This is significant for leaders to factor as they work with global data rules.
Where a server sits on a map isn’t the only thing that gives you independence. Digital autonomy really comes down to the laws and rules that look after your information. To truly understand this, we need to look at how different national laws can reach across borders.
In June 2025, the French Senate pointed out a gentle warning about this issue. A major cloud company shared that it couldn’t always protect data from being seen by foreign legal teams. This shows us that while physical location is nice, it isn’t the most important part of staying secure and sovereign.
Legal rules often follow the company itself, no matter where the actual hardware is kept. This can create a “legal reach” that might go past local storage rules. To help make this clearer, the image below shows five key things that decide your sovereign status.
It is helpful for teams to align their legal setup with what local regulators expect. This starts with a clear understanding of how jurisdiction works within a company. Let’s begin by looking at what causes these legal connections in the first place.
1 – Legal jurisdiction attaches to the operator
The U.S. CLOUD Act asks for data based on who “controls” it. Because this rule works all over the world, physical borders don’t always stop legal requests from happening.
In many legal tests, control is more important than location. Any provider following U.S. law might be asked to find data even on servers in other countries. This simply means we should focus more on who owns the company rather than just where the servers are.
Legal help under 18 U.S.C. § 2703(h) is mostly for countries with special agreements. Right now, India doesn’t have this type of agreement with the U.S. Because of this, customers in India may find it harder to stop these types of data requests.
This is something to consider when working with international cloud services. To stay safe, organizations should look at keeping technical care of their own space. This means taking direct charge of encryption keys and who can access the system.
2 – Custody of encryption keys and administrative access
Regulators in India feel that controlling access is the heart of digital sovereignty. It is often more helpful to control how data is unlocked than just where it is kept. This way, storage doesn’t automatically mean someone can read your information.
The SEBI cloud framework highlights how important it is to own your data. It asks companies to keep their own encryption keys. This is a kind way to ensure that providers can’t look at sensitive data without your permission.
Practical sovereignty resides with the key holder, not the storage operator.
When a provider manages your keys, they are the ones in control. While local storage helps things run fast, it doesn’t always offer full legal freedom. We should also look closely at who has access to the system to make sure everything stays secure.
Caring for the system and doing maintenance also brings up some questions about risk. It is a good idea to check which people have “emergency” access. You can use these four simple points to see if a vendor is a good fit for your sovereignty needs.
- The Team: It’s helpful to know who employs the support staff and which laws they follow.
- Working Location: Knowing which country they work from helps you understand which courts have a say.
- Access Rules: It is great to be clear about how access is given and what counts as an emergency.
- Open Audits: You should be able to see a record of every time someone accesses your data.
Many support models share access across different countries, which can get a bit complicated. This is true for the AI models themselves, too. Having control over the model is one of the best ways to ensure your setup is truly your own.
3 – Control over the model layer
In early 2025, some U.S. agencies paused the use of certain AI tools to keep things safe. NASA made this choice because the system infrastructure was located outside the country. These steps were taken to help make sure data stayed private and secure.
With hosted services, your questions and data are sent to another company. By hosting your own AI models, you can keep all that information safely inside your own walls. How you set up your system really changes how much control you have.
When you use hosted models, you have to follow the provider’s rules and laws. For real sovereignty, it is wonderful to be able to run models on your own equipment. This technical freedom is also being supported by new rules in India.
Running your own models helps protect your organization from sudden changes in prices or versions. Using open weights on your own servers can lead to a more stable future. Now, let’s take a friendly look at what Indian laws actually ask of us.
What Indian regulation actually requires
What Indian regulation actually requires
There is a little bit of confusion about whether all personal data must stay in India. Actually, the current law is quite kind and does not force all data to stay here. This was a careful choice made by the people who wrote the laws.
Section 16 of the DPDP Act allows data to be moved unless a country is on a restricted list. So far, the government hasn’t put any countries on that list. The strict rules from earlier versions were changed to be more helpful and flexible.
| Worth noting:There is one specific rule to watch. Rule 13(4) of the DPDP Rules 2025 says a committee can name certain categories of data that must stay in India. While they haven’t picked anything yet, the power exists. This is important for any company building a long-term plan. |
Sovereignty rules often come from the specific industry you are in, rather than just the general DPDP Act. For example, groups like SEBI and RBI have their own helpful rules for finance. The table below compares these different sets of rules for you.
| Instrument | Residency requirement | Key custody | Provider condition |
| DPDP Act 2023, s.16 | Negative list. Transfers permitted except to notified countries. None notified to date. | Not addressed | None |
| DPDP Rules 2025, Rule 13(4) | A committee may specify categories a Significant Data Fiduciary must keep in India. None specified to date. | Not addressed | None |
| RBI, Storage of Payment System Data, 6 Apr 2018 | The entire data relating to a payment system stored only in India, for unfettered supervisory access. | Not addressed | None |
| SEBI, Cloud Services Framework, 6 Mar 2023 | Data to reside and be processed within India. | Regulated entity retains ownership of data, logs and keys. HSM and KMS required. Keys held via BYOK or BYOE. | Cloud service provider to be MeitY-empanelled with valid STQC audit status. |
Many requests to keep data local come from internal teams who want to reduce legal risks. This is a smart way to plan for the future rather than just following a basic rule. You can use the framework below to help you choose the best AI partners.
Where Neysa fits
Neysa is built with care to meet even the highest standards of sovereignty. We are based and run entirely in India to make sure local laws always look after you. All of your data and records stay on equipment that we look after directly.
Our platform has top certifications to help you stay in line with DPDP and RBI rules. We make it easy for you to meet SEBI’s goals for owning and controlling your tech. We also promise, in writing, that you will always be the one in charge of your encryption keys.
