Topic starter
11/07/2026 8:22 pm
TL;DR: Cloud-routed ZTNA can move sensitive sessions through vendor-controlled points of presence, creating sovereignty and compliance risk even when traffic is encrypted in transit, according to Appgate. For IAM and security teams, jurisdictional control now needs to be proven in the access path, not assumed from policy alone.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Keeping Your Data Where It Belongs: How AppGate ZTNA Preserves Data Sovereignty”.
Key questions
Q: What breaks when cloud-routed ZTNA is used in sovereign data environments?
A: The control assumption that access enforcement and data residency are the same thing breaks first.
Q: Why does ZTNA routing matter for compliance and accountability?
A: Because regulators care about where data is processed as well as who can reach it.
Q: How should security teams validate ZTNA sovereignty controls?
A: They should validate the full session path, not only the access decision.
Practitioner guidance
- Inventory every ZTNA relay path Document the exact countries and cloud regions used by each access broker, PoP, and failover path before you treat the deployment as sovereignty-compliant.
- Require jurisdiction-aware routing controls Set policy so regulated sessions are only permitted when the access path stays inside approved jurisdictions and no vendor backhaul is involved.
- Evidence the access path for auditors Capture routing, relay, and region data as part of access logs so compliance teams can prove where sensitive sessions were processed.
Bottom line: Cloud-routed ZTNA can create a sovereignty problem even when authentication and encryption are working as intended.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:52 pm
Cloud-routed ZTNA creates a jurisdictional control gap, not just a performance trade-off. The architecture can satisfy access policy while still violating sovereignty rules if sessions traverse vendor infrastructure in the wrong region. That makes the control question broader than authentication or segmentation. Practitioners should evaluate where the path is enforced, not only where the policy is written.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prefer direct-routed or cloud-routed ZTNA for sensitive workloads?
A: For workloads with strict localisation, direct-routed ZTNA is usually the safer choice because it keeps the enforcement path under customer control. Cloud-routed designs can still be acceptable in lower-risk contexts, but only if the jurisdictional path, failover, and logging model are provably compliant. The decision should follow residency obligations, not convenience.
👉 Read our full editorial: Data sovereignty risks in cloud-routed ZTNA and access control