If your business migrated to the cloud between 2020 and 2023, there’s a good chance the project was marked “done” and nobody has looked at it since. That’s the gap.
The assumption nobody has re-checked
Migration answers one question: where does the workload run. It says nothing about who is actually in control of it, on what terms, or what happens the day those terms change without your input. Most boards have never been asked the second question, because the first one felt like the whole job.
What’s actually resting on that assumption
Consider what “done” is actually resting on. Data residency — where your data physically sits, and under which jurisdiction’s law it falls — was decided by configuration choices made years ago, by whoever ran the migration. Under UK GDPR, the Information Commissioner’s Office sets specific conditions on transfers of personal data outside the UK — and as we explain in UK Data Residency: Enforced, Not Promised, a contractual clause is not the same as a technical control, requiring adequacy or an appropriate safeguard. If nobody has actively confirmed your residency position since, you are relying on a default someone else chose, and you may not currently meet the standard you assume you do.
Vendor lock-in doesn’t announce itself either. It accumulates through decisions that each looked entirely sensible at the time — a proprietary data format here, a platform-specific identity provider there. None of them were wrong individually. But collectively, they now determine how easily you could leave your provider. Most businesses are unlikely to have tested that answer. Have you? And it isn’t just your exit terms sitting still while you look away — hyperscaler terms don’t either: pricing, data-handling terms, and platform capabilities change on the provider’s schedule, not yours.
What ownership actually looks like
Being in the cloud and owning your position in it are different things, and the difference is measurable. It comes down to three questions nobody has asked since the migration project closed: where does the data actually sit, what would it cost to leave this provider, and who currently holds the leverage in that relationship.
Every renewal moves this
Every contract renewal, every new integration, every platform update the provider ships moves this position — usually without your board noticing. The businesses most exposed are not the ones who never migrated. They’re the ones who migrated, declared victory, and never checked again.
Where this leads
The Sovereignty Index™ locates a business precisely on this spectrum — residency, contractual exposure, exit feasibility — so the position is a known fact rather than an assumption inherited from a project that closed years ago.