The four tests
Data residency: regulated data stays in-country, in an auditable facility. Key custody: encryption keys are held by the institution, not the provider, with hardware-backed management. Operational transparency: the provider can demonstrate who administers the platform and under which jurisdiction. Exit rights: contracted, tested ability to extract all data and workloads in a defined format within a defined window.
Staged adoption beats a big bang
The institutions succeeding with sovereignty move in rings: development and test workloads first, then internal analytics, then customer-facing systems with regulatory sign-off. Each ring proves the controls — residency audit, key ceremony, exit rehearsal — before the next moves. Attempting the core directly usually stalls on the exit-rehearsal clause, which is precisely the one regulators ask about.
Hybrid is the steady state, not a transition
Most Bangladeshi regulated workloads will stay on-premises or in-country hosted private cloud for years, with public cloud used for burst, dev, and non-regulated analytics. Design for that explicitly — consistent identity, networking, and operations across both sides — rather than treating hybrid as an embarrassment to be engineered away later.
