Technology sovereignty is becoming a much bigger part of the conversation around how we buy and use technology.
Much of that discussion is understandably being driven by governments. In April 2026, the Netherlands launched code.overheid.nl, a government-operated platform for developing and publishing open-source software. The stated rationale included increasing control over critical code infrastructure and strengthening digital sovereignty.
The UK is having a similar conversation around artificial intelligence. Its Sovereign AI initiative is backed by £500 million to support British AI companies, with the government arguing that the UK needs to be an AI “maker”, rather than simply a consumer of technology developed elsewhere.
It is easy to see why governments care. Technology now underpins national infrastructure, public services, policing, defence, intelligence and huge quantities of sensitive information. Becoming excessively dependent on companies controlled from another jurisdiction creates questions that go well beyond whether a particular piece of software works well.
Sovereignty isn’t a public sector issue alone. Banks, insurers, law firms, corporate security teams, private investigators and other organisations depend on many of the same cloud platforms, AI models, investigation tools and data services. They may not have an explicit policy objective to strengthen domestic technology capability, and they will understandably place much greater emphasis on finding the product that best meets the operational requirement. That does not mean questions about control, jurisdiction, access and dependency suddenly become irrelevant.
OSINT provides an interesting lens through which to look at this because the technology market is international. There are often perfectly good reasons to buy internationally. A more mature vendor might offer better functionality, more integrations, greater scale, more certifications or simply a product that solves the problem better.
The simplest definition of a British technology company might be one that was founded in Britain, employs a British team and owns its intellectual property through a UK company. A product developed and controlled domestically gives the UK a degree of capability that simply purchasing access to an overseas platform does not.
But even corporate ownership becomes complicated quite quickly. A British startup may have American investors. An international company may have a substantial UK subsidiary employing hundreds of people. A British business might later be acquired by an overseas parent while continuing to develop its product from the same London office.
That is why investment and ownership need to be separated. Receiving money from an American venture fund does not automatically make a British company American. The more relevant questions are who ultimately controls the business, where its intellectual property sits, who controls strategic decisions and what rights investors or a parent company have over its future.
There is also a difference between economic sovereignty and operational sovereignty. A company could contribute substantially to the British technology economy while still relying heavily on infrastructure and services provided from elsewhere.
Knowing where a vendor was founded therefore tells us something, but it tells us surprisingly little about what happens to a customer’s investigation once they log in.
The next layer is infrastructure. Imagine a US OSINT company offering British customers a dedicated service hosted in a UK cloud region. Its databases are in Britain, uploaded files are stored in Britain and its backups remain in Britain. From a data residency perspective, that could be a strong proposition.
Now imagine a British-owned OSINT company running its product in a cloud environment outside the UK.
Which is more sovereign?
The answer depends on what we are actually trying to protect.
Data location is clearly important, particularly when a platform contains sensitive personal information or investigative material. NCSC guidance recommends that organisations understand where information is stored and processed, while also warning that legal jurisdiction can be more complicated than simply identifying the physical location of a server.
That distinction matters because modern SaaS products rarely consist of one database sitting neatly inside one data centre. A platform might store its primary customer database in London while its logging platform operates elsewhere. Authentication might be handled by another provider, support through another, application monitoring through another and backups through another again.
The statement “your data is hosted in the UK” therefore needs more interrogation than it sometimes receives. A buyer needs to understand whether that applies only to the main investigation database or also to uploaded evidence, search histories, audit logs, application telemetry, backups and information passed to external processing services.
A vendor may be entirely accurate in saying that customer data is hosted in Britain while parts of the wider service still involve international infrastructure. That does not automatically make the platform unsuitable. It simply means that data residency is one component of sovereignty rather than the whole answer.
The same is true of the people operating the service.
Imagine again that an American vendor has created a UK-hosted environment for British customers. Its infrastructure is in Britain and data does not ordinarily leave that environment. The company also has a customer success team in London.
Then something breaks.
The engineer capable of diagnosing the problem is based in the United States. Can that engineer access the production environment? Can they view database records? What can they see in system logs? Could an investigation graph or target name appear while they are troubleshooting a problem?
A service can therefore be UK-hosted without being exclusively UK-operated. Equally, a British company can employ all of its developers and support personnel in Britain while hosting its application somewhere else.
For organisations with particularly sensitive requirements, the nationality of the corporate entity may be less important than understanding exactly which people, in which countries, can obtain privileged access to the service.
It is one reason why asking “Are your servers in the UK?” is probably no longer enough.
Artificial intelligence adds another layer. An OSINT platform could be founded in Britain, developed by British engineers and hosted entirely within a UK cloud region while still relying on an overseas AI provider for some of its most advanced functionality.
Perhaps an AI assistant summarises a person’s online presence, extracts entities from documents, proposes investigative leads or analyses a large relationship graph. The important question then becomes what information is being sent to the model to make that happen.
A prompt could contain a person's name, an investigator's question, existing intelligence about the subject and potentially extracts from documents that have been uploaded to the platform. An automated investigation could involve considerably more information.
This creates a distinction between where an investigation is stored and where parts of that investigation are processed. The underlying customer database could remain entirely in the UK while selected information is sent elsewhere for AI inference.
It is therefore becoming increasingly important for buyers to understand not just whether an OSINT vendor uses AI, but how that AI is architected. Which models are used? Where is processing performed? What information is sent to the provider? Is that information retained? Can it be used to improve a model? Can certain AI features be disabled for customers with stricter requirements?
The answers may vary considerably between vendors and deployment models. Again, this doesn't mean using an overseas AI model is inherently problematic. It means that calling a platform “British-built” does not necessarily tell us very much about its complete technology supply chain.
AI is only one example of the wider supply-chain problem.
If a British company runs on Amazon Web Services or Microsoft Azure, is it still sovereign? What if it uses an American identity provider, monitoring platform, analytics service, customer-support system or source-code repository?
Follow the dependencies far enough and achieving complete technological independence becomes extremely difficult.
Modern software is built on layers of other technology. Specialist providers exist precisely because it would make little economic or technical sense for every SaaS company to build its own cloud infrastructure, authentication system, AI model, payment processor and content-delivery network.
The useful question is therefore which dependencies actually matter.
There is a significant difference between a British OSINT vendor using an international email platform for marketing communications and that same vendor sending complete customer investigations to an overseas AI service for processing. Both represent foreign technology dependencies, but they do not represent the same level of operational or security risk.
A meaningful sovereignty assessment therefore needs to look at the architecture of the product rather than simply counting how many suppliers have foreign headquarters.
OSINT introduces another wrinkle because investigators are constantly accessing information held by external services.
Searching Companies House, local authority planning records or other UK public records is one thing. Searching international social networks is another.
If an investigator in Manchester searches for a British person's Facebook profile, it may be difficult, and possibly not particularly useful, to determine precisely which physical infrastructure served every piece of content involved in that request to determine if the search remained in the UK throughout.
The more meaningful sovereignty question is what happens around the collection.
Does an external service learn anything sensitive about the investigation? Is a third-party collection provider being used? Does an API act as an intermediary? Where is the resulting data stored? What information does the OSINT platform itself send outside its environment in order to perform the search?
There is an important difference between retrieving publicly accessible information from infrastructure overseas and sending confidential details about an investigation to an overseas organisation for processing.
For OSINT buyers, understanding the flow of information may therefore matter more than trying to determine whether every individual piece of source data remained within one national boundary.
There is another side to the sovereignty discussion that has less to do with server locations and more to do with whether domestic capability can develop in the first place.
Suppose an organisation is choosing between two OSINT platforms.
The first is provided by a large international company. It has raised significant investment, employs a substantial engineering team, has recognised enterprise customers and has already completed many of the certifications and procurement processes that a large buyer expects.
The second is built by a much smaller British company. Its technology is promising, its team understands the UK market extremely well and perhaps its data, infrastructure and operations offer a much stronger domestic sovereignty story. But it does not yet have the same breadth of functionality, customer references or corporate infrastructure as its larger competitor.
Choosing the established product is entirely rational. The buyer has an operational requirement to satisfy. It is not the buyer's responsibility to fund somebody else's product roadmap, and “British” cannot become a substitute for capability, security or reliability. But there is a circular problem here.
If large organisations are reluctant to trust smaller domestic suppliers until they have reached the scale and maturity of their international competitors, those companies struggle to win the customers and recurring revenue that would allow them to reach that scale.
Fewer large customers mean fewer reference accounts and less revenue to invest in product development. That can make raising further investment harder, which restricts hiring and slows product development. The resulting capability gap then becomes another reason for the next buyer to choose the established international supplier.
This is not a problem unique to OSINT. The UK has repeatedly discussed the difficulty of providing domestic technology companies with sufficient scale-up capital and the tendency for successful British companies to seek larger pools of capital overseas or eventually be acquired by international businesses.
For technology buyers, this creates an uncomfortable tension.
We can say that we want greater domestic technology capability while continuing to apply purchasing criteria that inherently favour companies that have already achieved scale. An individual organisation can make a completely rational purchasing decision while the aggregate effect of thousands of similar decisions is greater dependency on a relatively small number of established overseas technology companies.
That does not mean organisations should buy inferior software in the interests of industrial policy. It does raise a legitimate question about whether procurement models designed to minimise risk can inadvertently reinforce the very technology dependencies governments say they want to reduce.
If domestic technology capability is genuinely regarded as strategically important, investment policy and procurement policy probably cannot be treated as entirely separate conversations.
Could more organisations pilot products from smaller domestic suppliers before requiring them to demonstrate the capabilities as a multinational vendor? Could customers work with promising domestic companies on missing capabilities instead of waiting until every box has already been ticked?
For government, that question is particularly relevant. There is an obvious tension in investing public money to develop sovereign technology capabilities while procurement processes continue to make it extremely difficult for those same companies to become meaningful suppliers.
Technology sovereignty is therefore partly about protecting capabilities that already exist. It is also about creating the conditions in which domestic alternatives can emerge in the first place.
The argument for the private sector is inevitably different. A corporate security team does not have the same responsibility for national technological capability as a government department. Its priority is to protect its organisation and enable its investigators to do their jobs effectively.
If an American OSINT platform is substantially better than every UK alternative, there is a strong argument for buying it.
But private organisations still care about supplier risk, data protection, confidentiality, business continuity, acquisitions, third-party dependency and the long-term availability of strategically important technology. Those are all sovereignty questions.
That brings us back to the question that originally interested me. If two OSINT platforms genuinely met the operational requirement equally well, but one was domestically owned, developed and operated, should that give it an advantage?
I think there is a reasonable argument that it should. Not because buying British is inherently better, but because the decision can reduce certain dependencies while contributing to a domestic capability that may itself become strategically valuable.
The harder question is how much advantage it should receive when the products are not equal.
Rather than trying to determine whether a vendor passes or fails an abstract sovereignty test, buyers can get much further by understanding the different layers of dependency involved. Useful questions include:
Those questions tell a buyer far more than simply asking whether the company itself is British.
The more I think about this, the more I think there are really two related conversations taking place.
The first is defensive sovereignty: how much control do we retain over the technology we use and the information we put into it? That encompasses data location, jurisdiction, operational access, AI processing, ownership, infrastructure and the ability to move away from a supplier. It is primarily a risk-management question.
The second is capability sovereignty: do we have viable domestic organisations capable of producing strategically important technology ourselves? This is an economic and strategic question.
There are enormous advantages to having access to the best technology developed around the world, and artificial restrictions on overseas suppliers could leave investigators with worse capabilities for little practical benefit.
But the opposite position, that the nationality, ownership and infrastructure behind technology do not matter provided the product works, feels increasingly difficult to defend.
Technology platforms become dependencies. They hold information, shape workflows, accumulate institutional knowledge and become harder to replace the longer they remain embedded inside an organisation.
For OSINT teams, this is particularly significant because a platform may begin with public information but ultimately contain a highly sensitive picture of who an organisation is investigating, what it knows, what connections it has identified and what it intends to do next.
Sovereignty should therefore not be treated as a simple nationality test. A useful assessment asks who owns the supplier, who controls it, where the technology is operated, where customer information is stored and processed, who can access it, which jurisdictions apply, what technology sits underneath it and how dependent the customer becomes on those relationships continuing.
There is also a broader question that buyers, investors and governments may increasingly need to confront. We cannot simultaneously say that greater domestic technology capability is strategically important while creating an environment in which smaller domestic technology companies cannot win meaningful customers until they already possess the resources and maturity of global incumbents.
Sovereignty cannot become an excuse for buying technology that fails the operational requirement. But there is equally little value in demanding sovereign capability if nobody is willing to create the commercial conditions in which that capability can develop.