Our approach · Sovereignty
Your data stays where you put it. You can check for yourself.
Your security logs stay in your tenant, in the region of your Microsoft subscription. Our analysts work there remotely, with delegated rights you can revoke.
- of your logs stay in your own Log Analytics workspace
- 100%
- copies of your logs kept on our systems
- 0
- Azure role assignment to remove to cut our access
- 1
Three facts you can check yourself in your Azure portal.
Your tenant, service by service
Step 1 of 7
Your tenant, in your region
Your Microsoft 365 services, your security tools and your logs live in the same tenant, in the region your subscription carries.
Step 2 of 7
Your Microsoft 365 services
Exchange Online, Teams, SharePoint and OneDrive, your endpoints and servers, your business applications: each one produces its own activity logs.
Step 3 of 7
Entra ID, the way in
Every sign-in to your services goes through Entra ID, which records it in its sign-in logs.
Step 4 of 7
Purview protects the content
Sensitivity labels and data loss prevention rules apply to your email, conversations and documents.
Step 5 of 7
Defender XDR connects the signals
Endpoints, servers, email and identities: Defender XDR correlates alerts into incidents.
Step 6 of 7
Your logs land on your side, Sentinel analyzes them in place
Logs converge on your Log Analytics workspace, in your region. Sentinel is enabled on your subscription and analyzes them in place.
Step 7 of 7
Our analysts come in through a single door
Our access is a role assignment, with delegated rights, that you remove whenever you want. The data itself does not move.
It all comes down to one question: who owns the container?
An outsourced SOC and a sovereign SOC do the same job. They differ on one point of topology: where your logs land. That single point decides everything else: the format, the reversibility, the legal regime that applies.
Step 1 of 4
Your logs land on your side
Microsoft 365, Entra ID and your business applications send their logs to your Log Analytics workspace, in your region.
Step 2 of 4
Sentinel analyzes them in place
Sentinel is enabled on your subscription. The format is Azure native: KQL queries, native export, nothing proprietary.
Step 3 of 4
Our analysts look, and take nothing away
Delegated rights, under identities declared in your Entra ID. Every sign-in and every query leaves a trace in your audit logs, and no copy of your logs is kept on our systems.
From where: France and Vietnam under the Standard tier, only from within the European Union under the EU tier.
See both tiersStep 4 of 4
You remove the role, access stops
Our access is a role assignment you remove whenever you want. The data itself does not move.
The two models, point by point
| The usual modelYour logs move to the provider | The sovereign modelYour logs stay with you | |
|---|---|---|
| Where your logs go | The usual modelConnectors ship your logs to the provider platform, hosted wherever the provider decided. | The sovereign modelSentinel is enabled on your subscription, in your Log Analytics workspace, in your region. |
| The format | The usual modelThe format belongs to their tool: what you get back depends on what they agree to export. | The sovereign modelThe format is Azure native: KQL queries, native export, nothing proprietary. |
| When the contract ends | The usual modelEnding the contract means giving up a history that lives on their side. | The sovereign modelOur access is a role assignment you remove whenever you want. The data itself does not move. |
What actually holds that border
Four technical mechanisms. Each one can be checked from your Azure portal, without going through us.
Checklist · Azure portal
Tenant
The subscription is yours
Sentinel is enabled on your Azure subscription. The resource owner, the billing account and the data controller are one and the same entity: you.
Where to check it
Azure portal › Subscriptions › Access control
Region
The region is the one you picked
The Log Analytics workspace is created in a specific region, at creation time. Ingested logs are stored there and stay there, unless you configure an export elsewhere yourself.
Where to check it
Azure portal › Log Analytics › Location
Keys
Encryption can use your own keys
Data is encrypted at rest and in transit. You can replace the platform keys with your own, managed in Azure Key Vault, and rotate them on your own schedule.
Where to check it
Azure portal › Key Vault › Keys
Access
Our access is named and traceable
Our analysts work under identities declared in your Entra ID, with the delegated rights strictly required. Every sign-in and every query leaves a trace in your audit logs.
Where to check it
Azure portal › Access control (IAM) › Role assignments
Where your logs live, and who watches them
The first question is settled: your logs stay inside your subscription. The second is asked far less often, and it matters just as much: who, physically, reviews them, and from which country.
| Standard tier | EU tier | |
|---|---|---|
| Where your logs are stored | In your tenant, in your region, no copy on our side | |
| Coverage | Monitoring 24/7/365 | Coverage terms set in the contract |
| Team | Two locations, in France and Vietnam, across two time zones: in case of attack, handling in under 30 min, nights included (from SOC Standard) | Team based exclusively within the European Union |
| Log access | Your logs may be reviewed from France and from Vietnam | No access to your logs from outside the European Union, at any time |
| Who it is for | Private companies | Public-sector accounts, and any organization that requests it |
If you leave tomorrow
Reversibility is not an end-of-contract clause: it is a consequence of the topology. Nothing to bring back, because nothing ever left.
The data stays where it is
The workspace, the retained history and the analytics rules live in your subscription. Our departure does not move a single byte.
The know-how stays readable
Detection rules, KQL queries and playbooks are written in standard Azure formats. Your teams, or another provider, pick them up as they are.
Cutting us off takes one action
Removing our role assignment ends our access. No data to claim back, no export to negotiate, no waiting period.
What this architecture does not promise
Sovereignty is an easy subject to oversell. Here are the limits we state before signing rather than after.
Not legal immunity
Hosting in a European region does not mechanically place a vendor beyond the reach of every extraterritorial law. What the architecture establishes is storage location, resource ownership and key control, not the inapplicability of a foreign statute.
Not turnkey compliance
Staying in your region makes GDPR or NIS2 compliance easier; it does not constitute it. Records of processing, retention periods and impact assessments remain yours, with your DPO or legal adviser: we do not handle them.
Not a Microsoft exclusive
The reasoning holds for any architecture where you own the container. We demonstrate it on Sentinel because that is the platform we operate, not because it would be the only one able to do it.
Let us map where your logs actually live
The free audit is enough to map your sources, your Azure region and the access already in place. You leave with the diagram, whether or not we work together afterwards.
Checklist · Azure portal
Tenant
The subscription is yours
Region
The region is the one you picked
Keys
Encryption can use your own keys
Access
Our access is named and traceable