India's Sovereign AI Cloud

Abstract

"Data residency" and "sovereign cloud" have become loose terms in Indian cloud procurement conversations. The looseness now matters. The Digital Personal Data Protection Act of 2023, the RBI data localisation directives for payment systems, the MeitY guidelines for non-personal data, and the IT Act recent amendments together create a regulatory environment in which the specific layer at which sovereignty applies determines whether a given deployment is compliant or not. This paper proposes a three-layer framework to make the conversation more precise. Where the data physically sits is one question. Which jurisdiction's law governs access to it is a second. Who has operational control over the systems holding it is a third. These three questions can be answered independently, and the wrong answer at any layer creates regulatory exposure regardless of the other two. We describe the HyperNext Hyper 7 sovereign cloud platform as a concrete example of one set of design decisions across the three layers. The framework is non-proprietary.

Contents

1. 011. The phrase has become unclear
2. 022. The three layers
3. 033. The questions to ask
4. 044. The Hyper 7 architecture
5. 055. What this looks like in practice
6. 066. Detailed regulatory mapping
7. 077. International comparison
8. 088. Hyper 7 architecture detail
9. 099. References and standards

Key findings

• Layer 1, residency: where does the data sit, including all secondary copies?
• Layer 2, jurisdiction: which country's law governs compelled access to the data?
• Layer 3, operational control: who can technically reach the data, and from where?
• A workload is sovereign only if all three layers are satisfied. Failing any one layer is failing sovereignty.