Sovereignty Scorecard

Infrastructure Sovereignty

Q1: Data Ownership - Can you export ALL your business data and move to different platforms within 24 hours?

Yes, tested it Probably, but never tested No / Don't know

Q2: Backup Independence - If AWS/Google/Microsoft shut you down tomorrow, how long until you're operational?

<24 hours (we have backups) 1-7 days >7 days / Never

Q3: Password Security - Where are your business passwords stored?

Encrypted vault (Bitwarden, 1Password) Browser / Spreadsheet Sticky notes / Memory

Business Sovereignty

Q4: SaaS Dependency - How many SaaS subscriptions does your business pay for?

1-5 (lean) 6-15 (normal) 16+ (dependency)

Q5: Vendor Lock-In - Could you replace your top 3 business tools within 30 days without losing data?

Yes, we own the data Partially No, we're locked in

Q6: Cost Control - Do you know your exact monthly SaaS spend?

Yes, tracked and reviewed Rough estimate No idea

AI/Intelligence Sovereignty

Q7: AI Data Leakage - Do your team members paste confidential data into ChatGPT/Claude/AI tools?

No, we have private AI Not sure / No policy Yes, regularly

Q8: AI Dependency - If OpenAI/Claude went down for a week, could you operate?

Yes, we have fallbacks Reduced capacity Completely stuck

Q9: Prompt Ownership - Are your AI prompts version-controlled and owned by the company?

Yes, documented system Some employees have them Ad-hoc, in people's heads

Layer 8: Operator Sovereignty

Q10: Decision Fatigue - How many 'urgent' interruptions (calls/texts/Slack) do you get per day?

<5 (controlled) 5-15 (manageable) 15+ (cognitive DDoS)

Q11: Attention Control - Can you go 2 hours without checking email/Slack during focused work?

Yes, regularly Sometimes No, constant checking

Q12: Strategic Clarity - In the last 30 days, how often did you make decisions that conflicted with your stated mission?

Never / Once 2-5 times 6+ times / Don't track

Compliance & Risk

Q13: EU/UK Customers - Do you have customers in the EU or UK?

No EU/UK customers Some EU/UK customers Majority of customers in EU/UK

Q14: Regulations - Which regulations apply to your business?

None / Not sure One regulation (GDPR/CCPA/etc) Multiple regulations (GDPR + CCPA + HIPAA/etc)

Q15: Data Location Clarity - If a customer asked "Where is our data stored?" can you answer in 30 seconds?

Yes, documented and clear Partially (I think I know) No, would need to check