A Data Platform You Actually Own

Every managed data platform asks you to make the same trade. Give us your data, your identities, and your queries; we’ll give you convenience. It’s a good trade for a lot of people. It’s an impossible trade for some — and the some is growing.

A European bank under Schrems II. A government department that can’t put citizen data in a US-controlled cloud. A defense contractor. A healthcare system bound by data-residency law. For these, “the data lives in the vendor’s plane and the vendor’s jurisdiction” isn’t a footnote in the architecture diagram. It’s a disqualification.

This platform is built for that case. Not as a feature you toggle. As the reason it exists. Every component is open source and runs in infrastructure you control. There is no vendor plane. There is no jurisdiction but yours. That’s what sovereign means here, and it’s an architectural property you can verify, not a compliance badge you buy.

What sovereignty actually requires

The word gets used loosely, so let me be precise about what has to be true.

Your data never leaves storage you control. Here that’s an S3-compatible object store — MinIO, RustFS — running on your hardware or in your cloud account. The table files are Iceberg, an open format. No proprietary container, no vendor-managed bucket, no egress to anyone.

Your identities are yours. Authentication is Keycloak, your own OIDC provider. Users, roles, tokens — all in a realm you run. No identity federation to a SaaS you don’t control, no user directory sitting in someone else’s tenant.

Your catalog is yours. Apache Polaris — the Iceberg REST catalog that Snowflake open-sourced and donated to the Apache Foundation — runs in your stack, backed by your Postgres. The metadata about your data is as sovereign as the data.

Your compute is yours. Queries run on Trino, or on SQE, our own Rust engine, against your storage, authorizing through your policy engine. The query never leaves the building.

Your policy is yours. Authorization is Open Policy Agent, with Rego generated from your own grants. The decisions about who sees what are made by software you run, from rules you can read.

That’s the test. Data, identity, catalog, compute, policy — all five in your control, or it isn’t sovereignty. This platform puts all five in your control by construction, because every one of them is an open-source component you self-host. There is no sixth thing hiding in a vendor’s account.

It doesn’t phone home

Sovereignty isn’t only about where the data sits. It’s about what leaves.

The stack is configured to be silent. The observability layer ships with telemetry disabled. The AI flow builder ships with tracking off. No component is configured for outbound egress. The one optional dependency on an external service — OpenAI, for text-to-SQL and the AI assistants — exists alongside a local alternative, Ollama, specifically so you can cut the cord. Run the local model and nothing about your schema, your questions, or your data crosses your network boundary.

This matters more than it sounds. A platform that’s self-hosted but quietly streams usage telemetry to a vendor’s analytics endpoint is not sovereign. You have to be able to point at the egress config and show there’s nothing there. Here you can.

It runs where you run

There’s no hard dependency on AWS, Azure, or GCP. The production deployment path targets VMware Tanzu on a private cloud — in our case Schuberg Philis’s own — provisioned with Terraform, deployed with a Kubernetes operator. The local path is k3d on a laptop. The components are containers; they run on Kubernetes, and Kubernetes runs anywhere, including air-gapped and on bare metal.

If your constraint is “it must run in our own data center, on our own hardware, with no line to a hyperscaler” — that’s a supported deployment, not a special project. The same operator that stands it up on a private cloud stands it up on yours.

The whole modern stack, owned

Here’s the part that makes this more than a compliance story: you don’t give up capability to get sovereignty.

The platform assembles the full modern data stack from open parts and makes them behave as one system. A query engine. An Iceberg lakehouse with a real catalog. dbt, built into a browser IDE. Data contracts on the Open Data Contract Standard, with quality checks running on your engine. Column-level lineage. A virtual ontology — a semantic layer over the lake — queryable by AI agents over MCP. Text-to-SQL. An AI analytics canvas. Audit logging with OCSF forwarding to your SIEM. All governed through one identity, one catalog, one policy engine.

That’s not a stripped-down sovereign alternative to the commercial platforms. It’s the same surface area, built on components you can read, run, and own. The deep dives on dbt, data contracts, and the ontology show how far each one goes.

The trade-off, stated plainly

I’m not going to pretend this is free. Owning the platform means operating the platform.

You run the Postgres, and the quickstart runs one node — production HA is your responsibility. You patch the components. You hold the keys, which means you’re the one who can lose them. The convenience you’d buy from a managed vendor — the pager that’s their problem, the upgrade that happens while you sleep — is now yours.

And it’s younger than the incumbents. Some surfaces are deep and solid; others are built and not yet fully wired. There’s no row-level or column-level masking in the authorization layer today — it’s table-grain. The deep-dive posts name every gap I know about, on purpose, because a sovereignty pitch that hides its rough edges is just a different kind of vendor lock-in — the kind where you find out later.

So the honest framing is this: if a managed cloud platform can legally and politically hold your data, use one. They’re excellent, and someone else carries the pager. But if it can’t — if your data genuinely cannot live in someone else’s plane — then the choice isn’t between this and Snowflake. It’s between this and a pile of components you were going to have to assemble and integrate yourself anyway. This is that assembly, already done, governed as one system, with the sovereignty built into the foundation instead of bolted onto the brochure.

You own the data, the identities, the catalog, the compute, and the policy. You also own the operations. For the people who need the first list, the second is a price they were always going to pay. We just made the first list complete.