1. Legal category
Identify the applicable secrecy, confidentiality, data-protection and procedural rules.
Data · sovereignty · hosting
Judicial Data, Sovereignty and AI Hosting
Server location is not enough: the full access, administration and subcontracting chain must be understood.
There is no single category called “judicial data”
A court information system may contain public judgments, confidential case files, personal data, criminal data, evidence, professional working notes, security logs and technical metadata. The hosting and access model must therefore begin with classification.
Six layers to examine
2. Sensitivity
Assess the harm that disclosure, alteration, loss or unavailability could cause.
3. Location
Document where data, backups, support operations and logs are physically processed.
4. Access
Control administrators, subcontractors, support teams and privileged accounts.
5. Cryptographic control
Define encryption, key ownership, rotation and emergency recovery.
6. Exit and deletion
Specify export, certified deletion, evidence of destruction and continued access to archives.
Decision path before hosting is chosen
- Map data and processing operations.
- Determine the legal basis and applicable restrictions.
- Perform security and data-protection impact assessments where required.
- Examine supplier ownership, subcontractors and support access.
- Define the authorised architecture and cryptographic controls.
- Test restoration, continuity, portability and deletion.
Questions a decision-maker must ask
| Question | Why it matters |
|---|---|
| Who can technically read the data? | Contractual prohibition is not enough if privileged access remains technically possible. |
| Where are backups and support logs? | Secondary copies may escape the controls applied to the main environment. |
| Who controls encryption keys? | Key control determines who can ultimately decrypt protected information. |
| Can the service operate without external support? | Judicial continuity cannot depend on one remote supplier team. |
| Can all data be exported and verified? | Without tested portability, the state may become locked into the provider. |
Sovereignty is operational. It is not only a label on a contract. It includes control over data, access, keys, skills, versions, continuity and the ability to leave.