Who Owns the Data Your Business Creates?

I talk with Ehsan Darweshi and Georg Schmejkal about why “the cloud” creates real anxiety for teams handling confidential work and why QANAT is built around zero trust principles so you do not have to rely on a single vendor to keep data safe. We connect digital sovereignty to freedom, explain why AI accelerates lock-in, and map practical stages to make your toolchain more secure without throwing everything away.

• Cloud tools and the core question of trust in providers and their employees
• Why Web2 data ownership often feels real but is mostly an illusion
• Digital sovereignty versus privacy, explained with a simple metaphor
• Data gravity and vendor lock-in, especially in B2B stacks and supply chains
• Personal sovereignty as a bridge to digital sovereignty and better decisions
• Why AI increases urgency, from prompt injection to uncontrolled data exposure
• Private AI and private LLM options for companies with different budgets
• Why governments and enterprises now treat sovereignty as national resilience
• A staged roadmap: encrypt where you are, go hybrid, then build a sovereign ecosystem
• How data minimisation and transparency become a long-term trust advantage

You Do Not Own Your Digital Life Yet

Everyone says “everything is in the cloud”, but the cloud is just someone else’s computer, and that simple truth drives a deep business problem: trust. When your team uses Miro, Trello, Jira, Google, or an LLM like Claude, your confidential files and customer data often sit on platforms you do not control. The episode frames this as more than cybersecurity or compliance. It is about data ownership, digital identity, and the value you create online. If you cannot clearly answer who can access your data, who can copy it, and what happens when you leave, you do not really own the asset. For founders, CMOs, and operators, the risk is not abstract. It shows up as delays in adopting new AI tools, fear of leaks, and a creeping dependence on vendors you cannot easily replace.

A key theme is the illusion of ownership in Web2. We accept terms and conditions we rarely read, then act surprised when advertising gets uncannily personal or when platforms change the rules midstream. “If you are not paying, you are the product” is not just a slogan, it is a business model built on large-scale personal data collection and profiling. The practical consequence is low transparency: you cannot see where your data lands, who uses it, or how it shapes automated decisions about you. That is why the conversation shifts from “privacy” to “digital sovereignty”. Privacy can mean keeping something hidden inside a locked room. Sovereignty means having the freedom to choose where you go, what you use, and under which terms, without being tracked, profiled, or trapped.

The episode introduces two concepts that make sovereignty tangible for modern businesses: data gravity and vendor lock-in. When data stays inside a platform, that platform becomes harder to leave, especially once AI systems learn from your history. Even if you export files, you cannot easily extract the embedded context, workflows, and model improvements. This creates switching costs across your supply chain, marketing stack, and analytics. The proposed direction is a “zero trust” and “zero knowledge” approach where the platform does not need to store private data at all. Instead, private keys stay local, encryption protects information even when you use familiar Web2 tools, and you can decrypt and move your data when you choose. This is the “best of both worlds” framing: Web2 convenience combined with Web3 decentralisation principles.

AI raises the urgency. The episode compares an LLM integrated into a company to an internal employee without a contract, without a signed NDA, and potentially exposed to prompt injection or third-party access. Yet the goal is not to ban AI. It is to use AI in the right context with private conditions, including private LLMs that can run on your own machines or controlled servers so data stays inside your ecosystem. That matters for companies of every size, not only enterprises with big budgets. A practical path is described in stages: start by encrypting data while staying on existing platforms, move to hybrid setups using self-hosted services where it makes sense, and ultimately build a sovereign toolchain with private AI where you pay for consumption rather than lock-in subscriptions.

Digital sovereignty is also becoming geopolitical and operational. The UAE example shows how crises reveal dependencies, from food supply to data centre risk, pushing governments and institutions to treat digital sovereignty like energy sovereignty or financial sovereignty. For brands, the payoff is trust. Over the next decade, companies that minimise data collection, prove transparency, and let customers stay in control will earn credibility. The episode ends with a clear warning: the next lock-in is AI. Before you “train” a provider with your best information, pause and decide what sovereignty means for your personal life and your business, then choose tools that let you walk away.

PS: If people want to gain more information, they can visit qanat.io, and they are more than welcome to also join the QANAT community on Discord