A new compliance warning shows that many small businesses cannot clearly trace where stored data lives, turning sovereignty into an operational test, not just a policy phrase.