What Is Digital Sovereignty?
Companies are asking how much control they hold over the digital tools, data, and AI that run their businesses. Zoho's Chief Evangelist explains digital sovereignty, why it matters, and how to gain more control.
Watch on YouTube
22:28 
Zoho: Your life's work, powered by our life's work
A unique and powerful software suite to transform the way you work. Designed for businesses of all sizes, built by a company that values your privacy.
“Sovereignty is not binary,” says Raju Vegesna, Chief Evangelist at Zoho, which has made digital sovereignty a strategic priority. He sees sovereignty as a spectrum on which every company must decide where it stands and the level of control that makes sense for that organization.
Digital sovereignty, as Vegesna describes it, is a company's independence from the vendors whose tools it runs on. For example, he has seen providers cut customers off from tools such as email, chat, and video, each a communication channel that someone else controls. Digital payments raise the same concern, since a third party could stop a business from operating. He sums up sovereignty as “the tool plus data plus control.”
Key points:
- Sovereignty is critical for a bank or a government agency, where the organization sells trust, but a lower priority for a small business in survival mode.
- Control of a cloud deployment goes beyond data residency. Zoho's customers request arrangements in which the customer defines who administers the system, who controls the data, and who owns the encryption keys.
- Data residency rules do not cover what Vegesna calls knowledge residency. Data can stay where the rules require it, while the knowledge it contains, perhaps a pharmaceutical company's formulas, leaves with an AI model.
- Before connecting business data to a public AI model, companies should review the terms. Many don’t, Vegesna warns, leaving them with no control over whether their data is used to extract intelligence.
In Vegesna's view, the intelligence a company builds is becoming intellectual property. A business can keep it or let it go to an outside provider that may one day become a competitor. That choice is why sovereignty can drive competitive advantage, depending on the industry. He expects AI models to become efficient enough to run on a company's own computers, allowing a business to keep its data and intellectual property in-house.
Vegesna advises leaders to identify the most expensive or most important part of each product or service, then check whether the company owns it, controls it, or has a plan B. Zoho applies this reasoning to its own products: a company that does not own the most expensive part of its technology is effectively a reseller. The same questions apply further down the chain, and every company must decide where it wants to sit on the digital sovereignty spectrum.
Episode Participants
Raju Vegesna is Chief Evangelist at Zoho, the business software company. He joined the company around 2000, when it was called AdventNet.
Michael Krigsman is a globally recognized analyst, strategic advisor, and industry commentator known for his deep business transformation, innovation, and AI leadership expertise.
Chapter summaries
What does digital sovereignty cover beyond data?
For Raju Vegesna, digital sovereignty covers more than data: it also covers the tools in use and who controls them. He calls data “a subset of the broader thing”, and his short form of the idea is “the tool plus data plus control.” His examples are communication channels and digital payments, where another company could stop access. COVID exposed some supply chain issues in the physical world, he notes, and the trade wars are exposing some digital ones. In his telling, every business is asking how independent it is, and that is the right question because “we have all gone digital.” Watch this part 0:17
Can any company be fully sovereign?
No, by Vegesna’s account: “There is nothing called 100% sovereignty.” He describes a spectrum and asks where on it a company sits and what part of it the company is comfortable with. The test is whether it controls its mission-critical aspects, and if it does not, whether a plan B exists. An e-commerce business that depends on one or two vendors for financial transactions is his example of a company that needs one. He poses the same question for communication tools, since pretty much most businesses use digital tools to communicate. Watch this part 2:32
Who should set the terms of a sovereign deployment?
In the setups Vegesna describes, the customer sets them, including administration, control of the data, and ownership of the encryption keys. Michael Krigsman asked how that differs from the sovereign clouds every major provider sells. Vegesna drew no direct comparison and described what Zoho’s customers ask for: its data center under their control, cloud tools in a data center they define, or the tools on their own premises. Such requests are increasing, he reports, partly because some customers are “becoming uncomfortable with the control that exists within a handful of companies.” Watch this part 3:32
How can vendors and investors limit a company’s choices?
A vendor can withhold technology a company depends on, and investors can shape its direction. Vegesna draws both points from how Zoho operates. Vendors “may or may not license a certain piece of technology”, which is his reason for Zoho building its own cloud, databases, file systems, and applications and keeping third-party dependencies to a minimum. He compares a cloud company without its own cloud to a car company not owning its engine. When Michael Krigsman raised Zoho’s bootstrapped status, Vegesna agreed that sovereignty is part of the same philosophy, since investors “can influence you and influence your decisions”. Where a company draws the line, in his view, might differ. Watch this part 4:46
Why does control of a new technology matter?
Vegesna’s answer is historical: in each technology revolution, those who dominated the technology pulled ahead. He traces the pattern from steam engines through electricity and the digital revolution, and concludes that “the companies and countries that did not control some of those critical technologies fell behind.” He expects AI to follow, with companies and countries that dominate these advances ending up dominant. So he puts the question early in the cycle: “Are we going to be a player or are we going to let somebody else dominate it?” Watch this part 7:35
Do data residency rules protect what an AI model learns?
Not by themselves, in Vegesna’s account, because no rules are defined for what he calls knowledge residency. He uses a book: residency rules keep the book in the room, but a model can come in, read it, and leave. “Data stayed, knowledge left the room”. A pharmaceutical company’s drug formulas could be in that book. People have thought about data residency and are only starting to think about this. Vegesna gives that gap as the reason “we are also seeing on-premise come back”, since companies don’t want their intellectual property to walk out. Watch this part 9:15
What can companies lose by using public AI models?
Companies may lose intellectual property without realizing it, in Vegesna’s view. He sees a lot of businesses link business data to public models “without even reviewing their terms,” with no control over its use, which might include extracting intelligence. Behind this he finds an old pricing strategy: MCP, the pathway to the data, is free and open source, while models charge per token, much as razors are cheap and the money is in the blades. In his reading, the models are where the tokens turn into dollars. Watch this part 11:16
Will models get small enough to run on a company’s own systems?
Vegesna thinks they are heading that way, which is part of why Zoho builds its own models. NVIDIA, he points out, sees an order or two of magnitude of improvement at the hardware level, with more possible in models and applications. As evidence, he cites a 20 billion parameter model on the latest iPhone and about a 400 to 500 billion parameter model on a Mac Studio with an M5 Ultra. If individuals can do this, “it can be done at the company level as well”, so data doesn’t have to be centralized and a business can retain its intellectual property. He also sees “a long road ahead.” Watch this part 13:05
Is digital sovereignty only a compliance issue?
Not in Vegesna’s view: it “drives competitive advantage depending on the industry”, because intelligence is becoming a company’s intellectual property. A company builds that capability, then chooses between holding on to it and letting it go to “a central company who may in the future compete with you”. Michael Krigsman raised a U.S. export order that, in his telling, led Anthropic to switch off its most advanced models for every customer worldwide. Vegesna called it the latest case, after communication systems and financial transactions: “Now it has come to intelligence”. Watch this part 15:59
What works when rules conflict across countries?
Typically, Vegesna explains, the answer is a local entity that follows local regulations, as at Zoho, with a data center in the country governed by local bodies. He counts a local data center among the advantages of owning the cloud, since “we are able to deploy our entire stack” within the country and give customers control of it. Asked to list that stack, he runs from AI agents and applications through databases, operating systems, firewalls, and servers to data centers. He also acknowledges that “there are some aspects that we are not fully sovereign when it comes to chips and all of that”. Watch this part 17:17
What should leaders test before deciding what to control?
Vegesna’s test starts with the most important part of a product: a company that owns it, controls it, or holds a plan B for it is sovereign on that part. At Zoho the first question is the most expensive part, because without owning it “We are really resellers of the most expensive part.” The test runs down the chain, though “You don’t have to go all the way”. Priorities vary by size and business, in his account: a small company focused on survival ranks sovereignty lower, and it is critical for banks and government agencies selling trust. He adds that geopolitics also raises its priority. Watch this part 19:45
Related episodes
Chapters
Mentioned in this episode
Zoho products
- 17:58 Zoho stack: Vegesna’s list covers applications through data centers, with chips among aspects not fully sovereign.
Other companies and tools
- 12:06 MCP: free and open source, Vegesna argues, because it leads data to per-token models.
- 12:32 Android: Vegesna’s example of free distribution with the value captured elsewhere.
- 14:06 NVIDIA: Vegesna cites its view that hardware can improve by an order or two of magnitude.
- 14:31 iPhone: Vegesna’s evidence that models can run on devices, at 20 billion parameters.
- 14:43 Windows: Vegesna’s evidence of models becoming power efficient, at about 137 billion parameters.
- 15:06 Mac Studio, M5 Ultra: a desktop computer, Vegesna estimates, can run about a 400 to 500 billion parameter model.
- 15:59 Anthropic: Krigsman cites its switch-off after a U.S. order; for Vegesna, intelligence joins past cutoffs.
Related episodes
In this episode
Raju Vegesna: At some point, you've got to ask, are you a customer or are you a hostage? If you don't have a plan B, maybe you're a hostage.
Michael Krigsman: That's Raju Vegesna, chief evangelist at Zoho, which has made digital sovereignty a strategic priority.
Digital sovereignty covers tools, data, and control
Raju Vegesna: Sovereignty is not binary. It's about independence, freedom. We moved our lives into the digital ecosystem. We depend on tools to run our lives, businesses, and to some extent, even the countries. Do you still carry the freedom and independence that you wanted in this digital world? How dependent are you on some of the tools that you use? And who controls the plug? Can somebody pull the plug on your business? And you don't have a plan B. That's a question that a lot of businesses and countries are asking these days.
COVID exposed some of the supply chain issues in the physical world. And more recently, the trade wars are exposing some of the digital supply chain issues. And every business is asking, how independent am I? How independent is my business? How independent is my country? And this is the right question to ask because we have all gone digital.
Michael Krigsman: How is digital sovereignty different from data sovereignty or data privacy? It sounds much more all-encompassing.
Raju Vegesna: Data is a subset of the broader thing. Let's take communication. We are communicating here. Now, who owns the plug for a communication channel? We have seen cases where some of the companies pull the plug on their customers, not giving access to their tools for, let's say, an email or a chat or a video communication tool. That includes data, but it's a communication channel that somebody else controls.
Or another example is payments. Historically, the payments have been in cash. Now it's all digital transactions. But who is in control of those digital transactions? Can somebody else pull the plug and stop your business? So it's not just the data part, it is the tool plus data plus control.
Sovereignty is a spectrum, not a binary
Michael Krigsman: Raju, I've heard you describe digital sovereignty as a spectrum. Can you explain that?
Raju Vegesna: Sovereignty is not binary. You cannot say I'm fully sovereign. There is nothing called 100% sovereignty. It is a spectrum. Where in that spectrum are you, and what part of it are you comfortable with? And it's all about the balance.
And if there are some critical aspects of your business, mission-critical aspects, and do you control those mission-critical aspects? If you do not, then do you have a plan B? For example, if you're an e-commerce business and financial transactions are a key part, well, you're dependent on one or two vendors. Make sure that you have a plan B. If you're in the communication business or pretty much most businesses are using digital tools to communicate, do you have a plan B when vendor one pulls the plug on that?
Customers define control in a sovereign cloud
Michael Krigsman: Raju, every major cloud provider sells a sovereign cloud with data residency. What's the difference between that and the kind of control that you're describing?
Raju Vegesna: There are cases where customers are comfortable running their entire toolkit in our data center, but they control it. There are cases where customers want some of the cloud tools to be running in their data center that they define it.
And then the other end is they want to run the tools and control them in their premise, in their data center, onsite, within their control, where depending on the customer type, whether it is a country or a business in a particular industry, they are defining what that control level is, who administers it, who is in control of the data, who owns the encryption keys. All of these are defined by the customer. But the number of requests that we are seeing on this front is increasing, partly because some of these customers are becoming uncomfortable with the control that exists within a handful of companies.
Independence from vendors and investors
Michael Krigsman: Why is this so important for Zoho?
Raju Vegesna: We started as a sovereign company. We like to control our future and sleep well at night. That's a key part, meaning from financial sovereignty to sovereignty to make any decisions because we are a bootstrapped company. So we want to do what's right for the customer. And that sentiment runs across the board.
We've seen a lot of cloud companies not owning their cloud. It's like a car company not owning their engine. We need to own our own stack. That's why we ended up building our own cloud. And then we built our own infrastructure. We built our own databases or file systems, and then the software infrastructure or application firewalls, all the way to the applications so that now we are not dependent on third-party vendors who may or may not license a certain piece of technology out there.
Now, by owning and building our cloud, our own sovereign cloud, we are now able to take it and offer it to our customers who are on the same page and who want their own sovereignty. Because we control the stack, we are able to give them what they want. So it comes down to the number of dependencies that we have on third parties. In our case, we have minimized it.
Michael Krigsman: Zoho is one of the few technology companies of its size that is bootstrapped. It's so unusual. And you're saying that digital sovereignty is part of that same philosophy that has kept you from taking on investors?
Raju Vegesna: Absolutely, because that will change your decisions. A lot of people think your customer is who you sell your tools to, but if you have investors to whom you report your quarterly reports, they define some of the direction of the company and they can influence you and influence your decisions so that you can return to the investor. So we want to be sovereign when it comes to our decision-making. And that flows down to how we operate, how we make financial decisions, and how we make our long-term investment decisions and so on. So these are all related.
In our case, where we draw the line on sovereignty might differ from where some of the other companies or countries might make. We have drawn the line that we are comfortable making, and our customers are drawing a line based on their thing. At some point, we got to ask, are you a customer or are you a hostage? If you don't have a plan B, maybe you're not a customer, maybe you're a hostage.
Control of critical technology decides who leads
Michael Krigsman: We have to think of digital sovereignty as being tightly bound to the technology digital supply chain of an organization.
Raju Vegesna: Absolutely. Historically, we have seen that technology innovation leads to broadly innovation and taking over or dominance, I should say, at a global level. You know, there were some countries that contributed to a lot of, you know, countries' GDP, and before, let's say, the steam engines, the first industrial revolution. After the steam engines were invented, people who dominated the steam engines pretty much dominated the world.
And then later, if you look at the electrical revolution, then the companies and countries that dominated that obviously dominated the global trade. All the way to the digital revolution, the companies and countries that went ahead during that phase dominated that part. And then we are now about to enter an AI revolution where, again, companies and countries that dominated these technological advancements will end up dominating. At every phase, the companies and countries that did not control some of those critical technologies fell behind.
I'm saying this now partly because we are entering a new world with a newer technology in AI. And early on in the cycle, it is important to ask the question, where is our sovereignty? Are we going to be a player or are we going to let somebody else dominate it?
Data stays, but knowledge leaves the room
Michael Krigsman: Raju, how do we manage digital sovereignty in this age of AI and AI models?
Raju Vegesna: Whenever there is a new tool in the toolkit, every customer asks, what are our options? Are we in control? Are we sovereign on that? And there is this new tool called AI, and that changes the dynamics compared to other tools, partly because other tools created some things like data sovereignty and all of it. Now, there are no rules defined for knowledge residency because you have defined tools for data residency and other existing tools.
Michael Krigsman: Tell us more about knowledge residency and the relationship to maintaining a sovereign posture for organizations.
Raju Vegesna: Let's say data is a book. Data residency says data has to be here within my business or within the country. You're saying the book has to be here. Let's say somebody walks into the room, and let's call that person a model. They come, read the book, leave the room, leave the country. Data stayed, knowledge left the room, knowledge left the country. Are you sovereign in terms of knowledge?
You could be a pharmaceutical company and your formulas for the drugs might be in there. Data stayed because data residency rules were adhered to, but the know-how left the room. Nobody's thinking about that part. People were thinking about data residency. There are no restrictions on knowledge residency, and people are starting to think about it. Data is staying in the room currently. Knowledge is walking out of the room. And that is the reason we are also seeing on-premise come back because they don't want knowledge to walk out of their business because that knowledge is the intellectual property.
Public AI models can expose your IP
Michael Krigsman: Does the increasing use of AI pose a challenge to digital sovereignty?
Raju Vegesna: It does, partly because people are using AI without understanding its downstream implications. I see a lot of businesses connect their business data to public AI models without even reviewing their terms, and they don't have control over what their data is being used for, that might be used for extracting intelligence out of it. And they may realize that their IP is leaving the room and they don't even realize it.
This is a typical strategy that companies have adopted where the pathway to your home is given away for free so that you can charge at the house. So there's a reason MCP is free and open source and models are not, because MCP is a pathway to the home so that you can be charged on a per-token basis. And this is an age-old strategy where, you know, your razor is cheap because, you know, they make money selling you the blades. Or, you know, there's a reason Android is free, but apps are not, because one is a distribution mechanism, the other one is a value capture layer.
MCP is an easy way to get your data in. The value capture layer is really at the model layer so that the tokens are converted into dollars. People are not thinking through the implications on what they are losing because they think they're connecting the data. But what they're really giving up is really the intelligence part.
Owned models and edge AI preserve sovereignty
Michael Krigsman: Zoho is building its own models. Why are you doing that?
Raju Vegesna: There are a few layers to it. One, obviously, sovereignty. We want to control the critical ingredient that is going to be part of the future. Number two, as a technology company, you want to gain the know-how on the most interesting technology out there. And three, when we control the critical pieces of building the technology like AI, then we get to offer that to our customers as well.
And we get to customize it to the way we need. Because there are a few things: we consider the current models very inefficient from a power perspective. And we think the models will also move towards the edge. And we have our own convictions on how some of these models are to be built.
Michael Krigsman: Raju, you touched on power inefficiency and compute moving to the edge. Can you elaborate on that?
Raju Vegesna: NVIDIA itself at the hardware level thinks there is an order or two orders of magnitude of improvements possible. At the model layer, there are a couple of orders of magnitude possible. Similarly, at the application level, we know there are orders of magnitude improvements possible. If you multiply all of them, if there are significant efficiencies coming to AI, we are still very, very early in the game. That is the one level.
Then we also see the future of these models moving to the edge. You know, your iPhone currently, the latest version has a 20 billion parameter model, a mixture of experts model out there. Windows is now saying they are including about a 137 billion parameter model out there. So that is also proof that models are becoming power efficient and also moving to the edge. That also means your data doesn't have to be centralized. You are going to be in control of your own data. You protect your privacy.
And if you are able to do it at the individual level, it can be done at the company level as well. If you look at a simple, say, Mac Studio, the recent one, if you look at an M5 Ultra, you can run about a 400 to 500 billion parameter model on a single computer that goes on your desktop.
So we are entering the next phase of AI where models are shrinking in size due to distillation and all of that. Models are becoming power efficient. As a result, they are moving to the edge. That also means everyone as an individual can have our own models. And every business can retain their sovereignty, retain their intellectual property without giving up their sovereignty. And that is the direction we are heading. I think we are really in the early phase of AI, and there is a long road ahead.
AI raises the stakes for sovereignty
Michael Krigsman: This past June, a U.S. export order led Anthropic to switch off its most advanced AI models for every customer worldwide. It seems that AI raises the stakes for sovereignty because of issues like that.
Raju Vegesna: Absolutely. This is the latest case of that. We have seen communication systems switch off. We have seen the financial transactions switch off. Now it has come to intelligence, and that has raised alarm in several companies and countries.
Michael Krigsman: Many business leaders treat sovereignty as compliance. Does digital sovereignty also help drive competitive advantage?
Raju Vegesna: Digital sovereignty drives competitive advantage depending on the industry. We are getting to a stage where intelligence is your intellectual property. And you know, people are hired for two reasons, their physical ability or intellectual ability. And that's where intellectual ability is what brings all the knowledge workers together in a business, building that intellectual capability, and you build something. Do you want to keep it because that becomes your IP, or do you want to let it go to a central company who may in the future compete with you?
Owning the stack enables local control
Michael Krigsman: Zoho is headquartered in India, but you operate in the United States and many other countries. How do you handle conflicting regulatory environments when it comes to sovereignty?
Raju Vegesna: Typically, we set up that local entity locally, and we adhere to the local regulations. And one of the advantages of owning our own cloud is setting up our data center in the local country, and that is governed by the local bodies out there. So that is the best way. Because we control the stack, we are able to deploy our entire stack within and give them the control of that entire stack.
Michael Krigsman: You mentioned your entire stack, and you referred to that stack earlier. Can you just list off the components of that Zoho stack?
Raju Vegesna: At the topmost layer, whether you take AI agents or applications, we own all pieces of those applications. At the software layer, every single technology we have developed, including our audio video stack and whatnot. One level below, if you look at the application infrastructure, whether you take databases or file systems and all of that, we control that. And then if you go one level below, we are talking about operating systems and all of that. We had to create some custom versions of our own operating systems that are run.
And between these, there are also firewall application layer and others that are very, very specific firewalls designed for every single application out there. Then recently we started creating our own hardware out there where we have created our servers that are more efficient than the standard out-of-the-box servers out there. And then these servers are run alongside some of the custom switches. And below that, they are running in our own data centers out there. And of course, in some cases, they are powered by our own solar farms and whatnot. So these are various aspects.
Then there are some of the other aspects that we control to control the traffic as well. But this is a stack that we are able to control. Certainly, there are some aspects that we are not fully sovereign when it comes to chips and all of that. Obviously, hopefully we'll get there one day, but at least this particular stack, we are sovereign.
Michael Krigsman: Would it be accurate to say that sovereignty is a core strategic priority of Zoho?
Raju Vegesna: Absolutely.
Sovereignty is a chain of decisions
Michael Krigsman: What advice do you have for organizations that want to increase their level of digital sovereignty?
Raju Vegesna: Let me explain how we look at it. When we are about to create a product, we ask, what is the most expensive part of that particular product? And do we own that most expensive piece? If we do not, then we are not really the owners of the product. We are really resellers of the most expensive part.
If you're creating a product, as an example, what is the most important part of that particular product? Do you own that? And do you control that if you do not own it? So if you do not control it, then do you have a plan B? Then you are sovereign on that. And then you go down that chain. Whether that is a product or a service, we kind of look at it the same way. You don't have to go all the way, but you put yourself in a good position within that sovereignty spectrum that is necessary for your business.
Michael Krigsman: Sovereignty results from a series of decisions, that chain of decision-making.
Raju Vegesna: It's a chain of decision-making, absolutely. And that chain of decision-making varies by business and also business size. In a small business, you know, you are in survival mode. Sovereignty is down your priority list. But if you are, let's say, a bank, then sovereignty becomes critical because you're selling trust to your customers. And if you are a government agency, the primary thing you're selling is trust. The relation that you have with your citizens is trust. Then sovereignty becomes critical. So depending on where you are in the spectrum, sovereignty's importance rises.
And of course, obviously the geopolitical situation also improves or increases the priority of sovereignty as well. And that is the reality we are seeing currently.
Michael Krigsman: OK. Raju Vegesna, thank you for taking time to chat with us.
Raju Vegesna: Thank you, Michael. Great chatting with you.