Zoho’s Distributed Business Provides Unique Perspective on Digital Sovereignty
A Zoho billboard alongside Toronto’s Gardiner Expressway proclaims “Integrated Business Software in Canadian Data Centers.” Customers attending the Zoholics Canada 2025 conference might see it as they head back from the conference in the city’s west end. The mega-sized font reinforces a message hammered by Zoho executives at the end: Zoho – a software as a service (SaaS) company headquartered in India – can offer Canadian organizations control over their digital stack. And in the age of AI, where your data resides is only the beginning of a more complex question about digital sovereignty.
It all connects back to autonomy and control, and where you prioritize that control is a matter of perspective.
The concept of data sovereignty traces back to cloud computing becoming more commonplace. As businesses outsourced management of their infrastructure and software to technology services firms, those in regulated industries were hesitant because they didn’t want to run afoul of compliance. Data stored on foreign soil could be subject to the laws of a foreign government, and that represented a potential loss of control over personally identifiable information (PII) that regulators wouldn’t tolerate. To respond to those concerns, cloud providers launched local regions in different legal jurisdictions around the world – including Canada – so regulated industries could host their data there. Today it’s the norm for government, banks, and other regulated sectors to have at least some of their data in the public cloud.
Zoho, which manages its entire tech stack, announced the opening of two data centers in Canada in 2024 – one in Toronto and one in Montreal – to address this concern, naming it “digital sovereignty” in the press release. But in 2025 digital sovereignty goes well beyond where data resides. AI models that are built and operated in foreign countries, are trained on localized and undocumented data sets, and seem ready to disrupt much of the economy have become part of the equation too. Telecom providers in Canada and across Europe are campaigning their services on “AI sovereignty” and “digital sovereignty,” riding government pronouncements about the importance of a domestic AI pipeline for economic independence and resilience. They offer local infrastructure, data transit, and even LLMs as part of these “sovereignty as a service” packages.
At Info-Tech, we defined AI sovereignty from an enterprise perspective in our Tech Trends 2025 report as maintaining control over three key aspects as your organization pursues AI adoption: confidentiality, performance, and cost. Whatever your compliance obligations, the underlying goal is to maintain control over your organization’s knowledge capital. The trend builds on previous trend concepts including digital sovereignty and the self-sovereign cloud. It’s important to consider perspective when discussing sovereignty, as a national government will view it quite differently than an enterprise – especially one that’s operating globally.
Zoho’s Federated Approach to AI Sovereignty
So how does a SaaS provider like Zoho dissect digital sovereignty? Zoho’s Chief Strategy officer Vijay Sundaram weighed in during an interview at Zoholics.
“I definitely see a much higher awareness of sovereignty around things like data, AI, and privacy everywhere I travel in the last five months,” he says. “I’ve been to Australia, Brazil, the UK, and now Canada. One of the first things that people ask is where is the data stored? Who gets to handle it?”
Protecting data from a foreign government subpoena starts at the data center level and then calculates up into choices about AI model, he adds. Zoho’s response is to federate accountability for interacting with AI models. Customers can use Zoho’s Zia family of LLMs and know they are covered by Zoho’s terms and privacy commitments. Customers can also choose to use third-party models – including options like OpenAI, Deepseek, Qwen, or Meta’s Llama – and operate under the relationship they have with that provider. Even then, Zoho will take measures to protect data being fed into third-party models.
“Even if a customer uses a different model, and it’s submitting data from our model, we submit the metadata,” he says. “We submit the names of the fields, not necessarily the data and anonymize that. So you can understand the trends of the data and what AI is telling you your customer behavior, but the name of the customer never makes it out.”
In the months following ChatGPT’s launch, organizations rushed to update data governance policies to stop their sensitive data from flowing into an AI provider’s training data. The risks were a breach of private information, such as customer details showing up in publicly accessible models or business secrets becoming exposed for anyone to copy, enabling them to undermine a competitive advantage.
AI providers responded to that problem by providing enterprise-grade services. These services promise that customer data won’t be used to train the service provider’s own foundation models. Additional assurances are often made through customer-controlled encryption keys and isolated cloud tenants. Customers using these enterprise-level services receive API keys to access these AI models from other applications, like Zoho. So problem solved, right?
Apparently not.
Attending Zoholics Canada 2025 to speak on customer panels, Montreal-based children’s education company Mad Science operates in ten countries around the world, including Europe, North America, Africa, and Asia. A franchise business model, the firm hires “mad scientists” that can both entertain and educate children ages five to twelve as part of an after-school program or a birthday party. Mad Science Vice President of Finance Julien Magnan says the company is always mindful of meeting data residency compliance in the regions it operates in.
“It’s not just a one-size-fits-all approach. It has to be flexible,” he says. “It’s one of the reasons we went with Zoho.”
Zoho assured it could help Mad Science meet those data residency requirements in different regions. Since Zoho operates its own stack, including data centers hosting the application, that’s a claim it can back up. The next concern on the list in regards to sovereignty is AI. Magnan says Mad Science is in the exploration phase with AI but that it has to be careful.
“We’re heavily IP driven,” he says. “All the content we create is our own. So we have to be careful when we feed AI with our property.”
Mad Science has deployed ChatGPT Enterprise at its headquarters, but not across its franchise members. The guidance is that employees can use it for work – but not feed it any proprietary content. “We have to be careful about that,” Magnan says.
He’s aware of the measures taken and promises made by OpenAI to prevent customer data from being used for training. But he's not trusting it just yet.
“We’re not yet there in terms of, do we really trust this or not? We’re still being cautious,” he says. “The policy is to hold on, let us get more knowledge about it, and we’ll get back to you later.”
The intent is to embrace AI for all its benefits but have the necessary conversations to establish trust too.
The Costs of AI Sovereignty
Canada’s recently published framework for digital sovereignty defines it as maintaining autonomy over digital infrastructure, data, and intellectual property. The European Union definition – established in 2020 – says much the same, that member states can make their own choices regarding digital infrastructure, data processing, and technology development without depending on foreign actors. Building that autonomy comes with costs – Canada’s recent federal budget committed $925.6 million over five years to build a large-scale national AI compute and cloud infrastructure.
There will also be costs for global service providers like Zoho. Not only does it have to set up the data centers in the different regions where it operates, but it will also have to invest up the AI stack to assure customers they are in control. That includes technical capabilities to allow customers to manage their own encryption keys, their own identities and user access, and network access privileges. It also means building out its own LLM – Zia – in a multilingual approach that mirrors the language diversity in India.
“It puts pressure on us, we’re doing it right now, we’re making those investments,” Sundaram says. “But it also creates a receipt of a competitive advantage. Because our revenues, our global presence, is far more distributed than some of the largest companies – more than Microsoft, more than Salesforce, more than Oracle, more than SAP – if you draw up the pie of the top 10 countries, you’ll see our pie being much more diverse.”
That sort of distributed structure allows Zoho to sell into a market like Nigeria, for example, where Western vendors don’t touch that market.
Does that distribution help a customer that’s thinking about their own sovereignty and control over the AI stack? It at least presents a unique perspective that’s rooted in a different culture.
Want to Know More?
Digital Sovereignty: Canada’s New Political Frontier in Technology