Have You Ever Wondered Where Your Data Goes in the Cloud?

It isn't the sky.

It's a building. Probably in Virginia. Possibly in Ireland, if someone in procurement felt strongly about it. Your file sits in that building, fully assembled, next to ten thousand other companies' quarterly numbers, behind a login and a promise. The login is yours. The promise is theirs. Only one of those is enforceable, and it's not the one you think.

We've been sold a metaphor and we bought it whole. "The cloud" is a filing cabinet you don't own, in a country you didn't pick, with a key you were told not to worry about. The genius of the branding is that it makes a very physical, very jurisdictional arrangement feel like weather.

The Tuesday

Here is how it actually ends. Not in a breach. Not in a hack. In paperwork.

One Tuesday, a sealed order arrives at your cloud provider's legal department. Not at your office — theirs. You are not notified. You do not get a call. There is no breach notification, because nothing was breached. The system worked exactly as designed. The provider's lawyers read the order, confirm the data is reachable, and hand it over. They don't know your name. They don't need to. Your file was sitting there, intact, behind a key they could unwrap. Reachable means reached.

The "region" you so carefully selected from the dropdown? That governed where the disk spins. It did not govern who can compel the disk. The CLOUD Act, passed in 2018, settled that question with unusual honesty: a US-headquartered provider must produce data in its custody regardless of where on Earth that data physically lives. A bucket in Frankfurt, running on a US hyperscaler, is reachable by a US National Security Letter. Geography is not control. It never was. We just liked the dropdown.

The UK has its Investigatory Powers Act. China has its National Intelligence Law. Everyone has a version. The shape is identical: the company is the door, and the company answers to its home government, and your data is on the other side of the door.

The Canadian Flag Trick

The fashionable response over the last year has been to paint the door red and white. Stand up a Canadian holding company. Put a maple leaf on the website. Call it a "sovereign cloud." Reassure the board.

This is flag-washing, and it solves nothing. A Canadian reseller of a US-parented hyperscaler is still, at the bottom of the stack, a US-parented hyperscaler. The order doesn't go to the reseller. It goes to the parent. Sovereignty by corporate paperwork is the security equivalent of putting a "Beware of Dog" sign on a house with no dog. It works right up until someone checks.

Sovereignty that means anything has to be enforceable at the data layer — a property of the architecture, not the incorporation documents.

The Same Tuesday, Done Differently

Now run that Tuesday again, except this time your file went through SkyeConnex first.

Before it ever left your machine, it was encrypted. Then it was split — not copied, split — into seven shards using Reed-Solomon erasure coding. Five data shards, two parity. Those seven pieces were scattered across seven different storage providers, in as many different jurisdictions as you chose to spread them over. No single provider holds your file. No single provider holds enough of your file to be worth holding. Each one has a fragment of ciphertext that is, on its own, indistinguishable from noise.

The sealed order arrives. Same envelope, same Tuesday, same provider legal department. They open your "file" and find two-sevenths of an encrypted shard. Useless. Unreadable without four of its siblings, which are sitting in four other countries, wrapped in a key the provider has never seen and never will, because that key was never in unwrapped form on any server in the first place.

To actually comply, that provider would need four other governments to also produce their shards — simultaneously, before the audit log surfaces that anyone asked, and before you've rotated anything. Five jurisdictions, one synchronized yes. In practice the request dies at the second border.

So the provider says no. Not because they're brave. Not because they like you. Because they mathematically cannot say yes. You cannot surrender what you cannot reconstruct. That's the whole trick, and it's not really a trick — it's just arithmetic that nobody bothered to point at this problem until now.

Lose any two of the seven providers entirely — outage, bankruptcy, a government nationalizing a data center over breakfast — and your file is still fully recoverable. Compromise any one of them, and they've got noise. The math runs in both directions. Durability and confidentiality from the same move.

"What's My Exposure?"

The other thing about the building in Virginia is that you can't see inside it. Ask most providers where a specific file lives this morning and you'll get a certification PDF and a confident tone.

We answer it differently. There's a live map. It shows you, per file, which jurisdictions are holding which shards, right now. And there's a button that does something no compliance report can: it lets you click a country and watch the platform recompute, in under a second, exactly which of your files would be at risk if that country pulled cooperation tomorrow. Five Eyes. The CLOUD Act bloc. Pick your nightmare. The answer is on screen, in shards and percentages, not in paragraphs and reassurance.

Boards ask "what is our exposure?" and almost always get prose. We give them a number.

So, Where Does Your Data Go?

It goes everywhere. In pieces. On purpose.

It does not sit in a building waiting for an envelope. It is smeared across jurisdictions in fragments that mean nothing apart and everything together, and the only party on the planet who can reassemble it is the one who encrypted it in the first place. Which is you. Not the provider. Not the court. Not the person carrying the sealed order down a hallway in Virginia you'll never see.

Everyone in this market is selling trust. Trust is a relationship, and relationships can be compelled. We're selling math. Math doesn't get subpoenaed.

So — have you ever wondered where your data goes, and how it's used?

With us, the honest answer is good luck finding out.

That's not a bug. That's the product.

Originally published by Ross Norrie, founder of SkyeConnex, on LinkedIn.

Published June 1, 2026 · More from the SkyeConnex blog