A social graph is not a government registry, and it is not a technology company’s private estate. It is the living map of friendships, families, creators, communities, businesses, languages and institutions through which a society recognizes itself. The next argument over digital sovereignty will not be settled by asking where a server rack sits. It will be settled by asking who can combine that graph, who can infer from it, who can move it across borders, who can recover it after failure, and who can challenge the power built from it. Softa Technologies’ ZKTOR experiment in South Asia offers an unusually concrete test of whether a social network can remain globally usable while refusing the idea that global connection requires one global pool of human relationships.

The family group that crosses four jurisdictions before breakfast

Consider an ordinary family conversation. One sister lives in Delhi, a cousin studies in Kathmandu, an uncle works in Dhaka and another relative has moved to Europe. Before breakfast, the group has exchanged a photograph, a school notice, a medical update, a joke, a voice message, a small-business recommendation and the location of a family ceremony. To the participants, this is not “international data.” It is simply family life. Yet to the infrastructure carrying it, the conversation can touch several legal systems, several telecom networks, several cloud regions, several backup systems and several kinds of metadata. The family sees one thread. The operator sees account identities, delivery events, device changes, abuse reports, storage objects, encryption states, recovery paths and routing decisions. That difference is where the modern sovereignty question begins. The visible experience is unified; the authority behind it does not have to be. A platform may choose to make every participant’s records converge into one corporate repository because centralisation is simpler to operate, easier to analyse and often cheaper to scale. Or it can attempt the harder design: preserve a common conversation while keeping different kinds of authoritative data bounded by purpose, participant and jurisdiction. The first model treats geography as an implementation detail. The second treats geography as one of the limits on institutional power. Neither model becomes trustworthy merely because the company gives it a reassuring name. The point is that architecture decides, long before a privacy policy is read, whether global communication automatically becomes global possession.

The stakes are larger than messages. A social network gradually acquires a map of society. It sees who follows whom, who speaks in which language, which creator matters in which district, which communities overlap, which local businesses are trusted, which topics mobilise attention, which families span borders, which institutions act as hubs and which individuals connect otherwise separate groups. Add search, location, commerce, advertising and AI, and the map can become much richer than a list of contacts. It can become an identity graph, an interest graph, an influence graph, a mobility graph, a commercial graph and, if behavioural profiling is allowed to expand without restraint, a prediction graph. That is why the phrase “social graph of a nation” needs care. A nation does not own the relationships among its people. A government does not acquire a moral right to read them because they occur within its territory. A platform does not own them because it stores the edges. And an advertiser does not own them because it can buy access to categories derived from them. The social graph exists because people relate to one another. The institutional question is narrower and more demanding: which actor is allowed to process which part of that graph, for what purpose, under which jurisdiction, for how long, with what technical limits, and with what route for a person to challenge misuse? Sovereignty becomes meaningful only when it reduces unbounded power rather than merely relocating it.

Global connection quietly became global concentration

The first generation of social platforms solved an extraordinary problem: they made distance cheap. A student in a small town could speak to a professor abroad. A migrant could remain inside the daily life of a village thousands of kilometres away. A local musician could be heard outside the distribution system of a broadcaster. A business could reach a customer it had never met. These gains depended on global infrastructure, common protocols, large-scale storage and the ability to move information across networks without forcing the user to understand the geography underneath. Centralisation helped create that experience. One account worked across cities and countries. One feed followed the user. One archive held years of photographs. One company could optimise reliability, moderation, recommendation and advertising across a huge population. The problem is not that global platforms became global. The problem is that global usability often arrived bundled with global informational concentration. A single company could gradually hold the identity, communication, audience, advertising and behavioural histories of people living under different laws, cultures and political systems. What began as an engineering convenience became an institutional fact: billions of relationships could be made legible to one corporate decision-making structure.

That concentration changes the nature of risk. A breach is more consequential when the repository is larger. A bad internal permission is more dangerous when the employee tool can traverse countries. A flawed recommendation model has wider social reach when one system ranks many societies. A commercial decision to combine products becomes more powerful when the company already controls multiple graphs. A lawful demand in one jurisdiction can become complicated when the relevant data are physically, logically or contractually entangled with people elsewhere. An acquisition can move the practical authority over years of social history from one institution to another. Even without misconduct, the company accumulates a form of infrastructural power: it becomes the place where relationships are stored, interpreted and increasingly mediated. The central question is not whether such a company is good or bad. It is whether a civilisation that depends on digital relationships should make concentration of those relationships the default technical condition of connection. The answer matters more in the AI era because machine learning turns accumulated histories into models. A database records what happened. A model can estimate what may happen next, who resembles whom, which person may influence another, which user may be persuadable, which community is growing, and which signal may predict a purchase or a political interest. The social graph therefore becomes not only a record of society, but raw material for institutional prediction.

The law has already begun to recognise that data cannot be treated as if borders and purposes were irrelevant. Europe’s GDPR does not prohibit international transfers, but it requires safeguards when personal data move outside the European Economic Area. The Digital Services Act separately requires the largest platforms to offer at least one recommender option not based on profiling. India has taken a different route: the Digital Personal Data Protection Act allows the central government to restrict transfers to notified countries or territories, while the 2025 Rules add phased obligations and allow specified restrictions around certain personal data and related traffic data. These regimes are not identical, and none of them says that every byte must remain in the country where a person lives. They illustrate something more important: jurisdiction remains relevant even on a global network. The protection attached to personal data is not supposed to disappear merely because an infrastructure diagram crosses a border. At the same time, legal compliance cannot answer every architectural question. A company may comply with transfer rules while still centralising far more information than its service requires. It may store data locally while centralising keys, logs or decision-making elsewhere. It may satisfy a residency commitment for a primary database while sending backups and analytics exports to another region. Law defines minimum obligations and legitimate authority. Architecture decides how much power the company chooses to keep even when the law would allow more.

Data location is the beginning of sovereignty, not the end

The simplest version of digital sovereignty says: keep the data in the country. That can be useful, but it is incomplete. A record can sit on a server in Delhi while the decryption keys are controlled from another jurisdiction. A backup can be copied abroad. A support console can expose the record to staff elsewhere. An analytics pipeline can export derived information even if the original object never moves. A global identity service can link the local account to a broader profile. A recovery process can route through a foreign system. A content-delivery network can retain traces. A fraud system can reconstruct social relationships from metadata. A third-party AI service can receive user requests or content fragments. A local database can therefore exist inside a globally centralised authority model. Physical residency answers one question: where is this object stored? Sovereignty asks several more: who can read it, who can derive from it, who can move it, who can delete it, who can restore it, who controls the relevant keys, who can alter the access rules, which law governs the operator, and whether the user has any practical remedy when the answer changes.

A deeper layer sits above storage: the control plane. A company can distribute databases across countries and still govern them from one global administrative centre. The control plane decides which services can connect, which operator roles can escalate access, where keys are created, how certificates are issued, which software version is deployed, which feature flags are turned on, which analytics jobs run and which emergency actions can override normal permissions. In cloud systems, this plane can be more powerful than the data plane because it determines the rules under which local data are processed. If the control plane is globally omnipotent, local storage may limit some transfer risks without meaningfully limiting corporate authority. A jurisdiction-aware architecture therefore has to document the geography and governance of control itself. Does an administrator in one region have the technical ability to query another? Can a central service change a retention rule without local approval? Are encryption keys generated and held inside the relevant boundary or merely referenced there? Can a software update silently create a new outbound data flow? Which actions require multiple people, which are logged, and which can be reversed? This is where the idea of constitution before capital becomes engineering rather than philosophy. The operator voluntarily gives up some emergency convenience so that no single employee, service account or executive decision can casually collapse the boundaries. A mature version of Ek-me-Anek would therefore be judged not only by where user records rest, but by where power to alter those records resides.

The reverse is also true. Cross-border transmission does not automatically equal surrender of sovereignty. If two authorised participants in different countries are communicating, information must cross a border in some form. The recipient cannot receive a message without receiving data. The meaningful distinction is between necessary communication and persistent central possession. A jurisdiction-aware design can allow an encrypted object to travel to an authorised recipient while keeping the authoritative server-side record, keys, backups and governance tied to a defined region. That does not make the system magically immune from law, hacking, device compromise or recipient misuse. It simply rejects the assumption that one conversation requires one globally unified corporate archive. This is the conceptual territory Softa Technologies calls Ek-me-Anek, roughly one experience with many bounded data homes. In the company’s description, a coordinating layer can operate applications and APIs while user data remain in country-specific clusters. Softa says its South Asian architecture uses country-local arrangements for India, Nepal, Bangladesh and Sri Lanka, with primary and disaster-recovery facilities intended to remain within the relevant country boundary. The claim is significant precisely because it is testable. A serious audit would need to trace not only databases, but keys, logs, thumbnails, message queues, support exports, backups and failover behaviour. Sovereignty that survives only in a diagram is branding. Sovereignty that survives failure is architecture.

That is why disaster recovery may be the most revealing part of the system. Engineers design backups for the day the main site is unavailable, corrupted or compromised. In an ordinary cloud architecture, resilience can encourage geographic replication: copies are spread across regions so that one failure does not destroy the service. The logic is sound. But a company that promises country-bounded data cannot quietly suspend the promise when disaster strikes. If an Indian primary cluster fails and recovery happens from a foreign copy, the operational system has declared that sovereignty is optional under pressure. If the data stay local but the keys needed to restore them are administered globally, practical control may still have moved. If a restored backup recreates an old privacy setting or an earlier permission, the system has preserved data while failing to preserve the user’s latest decision. The hard engineering idea is therefore not simple localisation but sovereign resilience: the relevant boundaries should survive outage, restoration, supplier change and incident response. This costs money. Smaller markets may need local capacity that looks inefficient when judged only by short-term utilisation. That is the point. A constitutional limit on institutional power is meaningful because it sometimes prevents the operator from choosing the cheapest or simplest route.

A social graph is more sensitive than a content archive

Photographs and messages are obvious forms of personal data. Relationships are quieter. A platform can know very little about the content of communication and still know that two people speak every night, that a person has joined three health-related groups, that a local organiser suddenly gained followers in five districts, that a teenager’s network shifted after changing schools, that a small business depends on one supplier community, or that a diaspora group regularly coordinates with people in a particular hometown. Social metadata can reveal structure even when content is encrypted. This is why the social graph deserves its own governance language. It is not simply another table in a database. It can expose association, dependence, influence and vulnerability. In authoritarian hands, such a graph can help identify networks of dissent. In commercial hands, it can improve targeting and prediction. In criminal hands, it can enable fraud and coercion. In poorly designed AI systems, it can become a training signal that teaches the model which people and communities are connected. Encryption protects content in transit and at rest only within its threat model. It does not automatically prevent an operator from creating an extensive relationship graph from metadata the service legitimately needs for delivery.

A rights-first platform therefore has to minimise not only readable content but unnecessary graph construction. This is where Softa’s wider doctrine of Privacy and Data Safety by Design becomes more interesting than a generic promise of encryption. The company describes ZKTOR as operating without behavioural tracking and personal profiling, with protected media handled through a No URL Media approach and protected information governed through a scoped Zero Knowledge Server Architecture. Those phrases require precise boundaries. “Zero knowledge” cannot mean the server knows literally nothing; accounts, delivery states, abuse controls and other operational data still exist. “No behavioural tracking” cannot mean the service performs no security logging or relevance processing. The defensible claim is narrower: necessary service information should not automatically become an enduring commercial theory of the person. Applied to the social graph, that means an edge created for following, messaging, joining a community or delivering a post should not automatically become raw material for unrelated advertising, political inference, universal AI memory or cross-product scoring. The difficult part is enforcement. Purpose separation has to survive schema design, analytics, internal APIs and executive requests. A product can promise separation in policy while engineers quietly build a universal identifier that makes combination trivial. The architecture must make overreach harder, visible and auditable.

Derived data make the problem even more difficult. Suppose the platform keeps raw relationships in country-local systems but trains a central model that learns which accounts are influential, which communities cluster together, which language groups respond to which themes and which users are likely to know one another. The raw graph may never be exported, yet much of its informational value has been. Embeddings, audience segments, propensity scores, anomaly models and recommendation features can function as compressed social graphs. They are not always personally identifiable in the simple sense, but they can preserve structure that matters. A sovereignty architecture for the AI age therefore has to answer whether derived representations inherit the restrictions of the source. If a health-related community graph is protected from advertising, an embedding produced from that graph should not become advertising input through a technical loophole. If a child’s exploratory interests are not supposed to create a lasting profile, a model trained on those signals should not preserve the same conclusion after the raw events are deleted. If a country’s social graph is meant to remain bounded, a global model should not quietly become the place where its relationships are reconstructed. This does not imply that every aggregate statistic must remain isolated. Platforms need security models, spam detection, capacity planning and public-interest analysis. The rule has to be purpose-sensitive: derived information should be no more reusable than the data authority from which it came. In modern systems, sovereignty of the source without sovereignty of the inference is an incomplete promise.

This principle becomes especially important when a company builds more than one product. Softa’s planned ecosystem places ZKTOR in public social participation, SNDESH in private communication, KHOZU in search and evidence, HOLA AI in bounded multilingual assistance, ZHAN in contextual advertising, EZOWM in commerce, ZWATO in business administration and Subkuz in editorial publishing. Integration can make each service more useful. It can also create the temptation to construct a single super-profile. A person who searches for a disease, messages a relative, follows a doctor, buys a product, asks an AI assistant a question and reads a local news article could be reconstructed into an extraordinarily intimate dossier if every product shared one behavioural memory. The more integrated the ecosystem becomes, the more important purpose separation becomes. The future internet cannot merely replace a foreign super-platform with a domestic super-platform that learns the same amount about the user. The stronger proposition is integration without surveillance centralisation: products can cooperate on a chosen task without receiving a permanent licence to merge every signal. Jurisdiction limits where authority sits; purpose limitation constrains what that authority may do.

The group chat is a better sovereignty test than the flag on a data centre

SNDESH, Softa’s planned private messenger, makes the sovereignty problem concrete because messaging refuses to stay inside one jurisdiction. A group can contain participants in India, Europe, the United States and Nepal. The user expects one coherent conversation. A naive localisation model would force the whole group into one jurisdiction, duplicate everything everywhere, or break the experience into fragments. Softa’s engineering concept instead separates what the participants experience from where authoritative encrypted objects are meant to remain. In the company’s design, message-level objects associated with different participants can remain anchored to designated country or regional infrastructure while authorised participants receive the encrypted information needed to see the same thread. SNDESH is not yet a mature public service whose every property can be treated as independently verified fact. It is useful here as an architectural proposition because it asks the right question: can a conversation be global without making its server-side history globally centralised?

That question exposes the limits of simplistic sovereignty slogans. If a participant in India sends a message to a relative in Europe, the message has crossed a border by definition. If both are authorised participants, the foreign recipient has a legitimate copy on a device. If the user takes a screenshot, the sender’s server architecture cannot repeal physics. If the recipient’s device is compromised, country-local storage does not save the content. If lawfully authorised investigators require evidence, encryption and jurisdiction do not erase due process. The design goal is not impossible containment. It is bounded institutional possession. The operator should not need to create a permanent globally readable archive merely because the participants are global. Softa describes SNDESH as a three-layer encryption design: device or profile-to-profile protection, per-message or line-level keys, and a server-side layer with rotating key state. Those claims still require technical validation, threat-model documentation and independent testing. Their conceptual importance is that sovereignty and cryptography are being treated as connected questions. A country-local encrypted database is weak if the operator can casually decrypt everything. Strong encryption is incomplete if all metadata, keys and recovery authority converge in one global centre. The architecture has to bound both geography and knowledge.

Sovereignty can fail through metadata, support tools and AI

The most sophisticated data architectures are often defeated by the least glamorous systems. Support staff need to help users recover accounts. Safety teams need evidence to review harassment and impersonation. Fraud teams need to recognise coordinated abuse. Engineers need logs when delivery fails. Finance teams need campaign and payout records. Each of these needs can create a side channel around the formal privacy architecture. A support export may contain identifiers from several jurisdictions. A crash log may include object names. An anti-abuse graph may persist relationships long after the original event. A backup inventory may reveal which communities are active. A customer-service platform may be hosted in another region. If the public claim is that a country’s user records remain in a country-specific cluster, the organisation has to decide whether the claim applies only to the main database or to the wider evidence ecosystem. Mature sovereignty requires data-flow accounting at the edges, not just in the centre.

AI makes the edge problem harder. A generative assistant can turn a narrow request into broad data exposure if the system sends more context than the task requires. A user asks HOLA AI to translate one post, summarise one thread or explain one public article. The easiest implementation may send a large conversation history, social profile or cross-product context to the model so that the answer feels personalised. That convenience can quietly rebuild the super-profile the rest of the architecture was designed to avoid. Softa’s stated HOLA direction is bounded assistance with human authority and without a universal cross-product AI memory. The principle matters beyond one product: an AI layer should inherit the purpose and jurisdiction limits of the data it touches. A private message does not become general training data because an AI feature was invoked. A local business record does not become social-feed targeting material because both products belong to the same company. A sensitive search does not become an advertising segment because an AI answer was generated. In the AI era, sovereignty is partly the right to prevent context from becoming universal memory. The most dangerous central repository may not be a database. It may be a model or embedding system that can reconstruct meaning across products without storing the original rows in one place.

The same logic applies to deepfakes and identity protection. Synthetic media turns faces, voices and public relationships into exploitable assets. A creator’s social graph can be used to make an impersonation more convincing: the attacker knows which colleagues to mention, which local business to imitate, which language to use and which followers are likely to trust the message. A woman running a public-facing business may need visibility without exposing her private household network. A child should not have an experimental identity permanently bound to a behavioural graph that follows them into adulthood. A privacy architecture that focuses only on secrecy misses these harms. Digital dignity requires control over how identity, relationships and media can be recombined. ZKTOR’s Women & Children Wing, grievance structure and VDL-style protective AI are attempts to put safety into the institution, but safety itself must be bounded. A safety system that responds to abuse by continuously monitoring every private relationship would solve one risk by creating another. The harder standard is safety without general surveillance: accessible reporting, proportionate evidence, narrow investigation, human review, appeal and technical controls that reduce predictable misuse before it spreads.

Local law matters, but sovereignty is not permission for unlimited state access

Digital sovereignty is often discussed as if the only choice were foreign corporate power or domestic governmental power. That is a false binary. A platform can reduce foreign concentration while still protecting people from excessive domestic access. The location of data does not erase constitutional rights, procedural safeguards, encryption or the need for lawful authority. In some jurisdictions, local storage can make legitimate enforcement simpler. It can also make political pressure easier if the operator has not designed strong access controls and due process. A sovereignty architecture therefore needs a theory of state requests as carefully as it needs a theory of cloud storage. Who can demand data? Which entity receives the order? What categories can the company technically provide? Which data remain inaccessible because they are encrypted end-to-end? What is logged? Can the user be notified when law permits? What happens when orders conflict across borders? How does the platform prevent one local administrator from becoming an invisible master key?

This is where the word sovereignty should return to the individual. A country has legitimate authority to enforce its laws within constitutional and international limits. A company has legitimate authority to operate and secure its service. Neither relationship turns the person into property. The user retains rights and interests that both institutions must respect. The social graph is not a national asset to be mined by the state, just as it is not a corporate asset to be monetised without limit. A mature system distributes authority. Government can make lawful demands through defined process. The operator can protect service integrity and comply where required. The user can encrypt, delete, appeal, correct and understand. Independent institutions can scrutinise claims. Technical architecture can ensure that no actor receives more power than the task requires. This approach is less emotionally satisfying than slogans about data nationalism or borderless cyberspace, but it is more defensible. The objective is not to make data politically immobile. It is to make power over data bounded, attributable and challengeable.

The architecture also has to survive conflict between jurisdictions. Imagine a group conversation with participants in three countries. One country issues a lawful order for records tied to its resident. Another country’s law restricts disclosure of related data. A third participant has rights that neither authority can casually extinguish. Centralised systems already face these conflicts, but distributed sovereignty makes them visible at the architecture layer. The platform needs an entity map that identifies which legal company controls which records, a process for narrowing demands to the authorised scope, a method for segregating data belonging to uninvolved participants, and escalation when orders conflict. Encryption can reduce what the company is capable of providing, but it cannot replace legal analysis. Local entities can improve accountability, but they can also become pressure points. Transparency reporting, legal review, access logging and narrowly scoped disclosure therefore belong inside the technical design. The best sovereignty model is not the one that promises to resist every government or obey every order. It is the one that makes authority legible enough that neither corporate discretion nor state demand can expand invisibly.

The commercial model decides whether sovereignty survives success

Architecture is vulnerable to economics. A young platform may sincerely minimise data while it is small, then discover that behavioural advertising pays more when the audience grows. Investors may ask why local datasets are not being combined. Product teams may want one identifier across social, search, commerce and messaging because experimentation becomes easier. Advertisers may want audience segments based on inferred interests rather than explicit context. AI teams may want historical data because more context improves model performance. The sovereignty question therefore cannot be separated from the business model. If revenue depends on centralising and interpreting more human behaviour, the company will face permanent pressure to weaken the boundaries it originally advertised. If revenue can come from contextual advertising, professional services, creator economics, merchant tools and local commerce, the organisation has more room to preserve informational restraint. This is the institutional version of technical debt: a company can accumulate surveillance debt. Every new revenue system that assumes universal identity makes future separation harder. Every central feature store makes a later promise of purpose limitation more expensive. Every acquisition that merges identifiers increases the political and security value of the combined graph. A company serious about sovereignty has to measure these pressures before they become irreversible architecture. Board-level governance therefore matters. New monetisation proposals should have to explain which data they need, whether a less intrusive signal could perform the same task, whether the data cross a purpose or jurisdiction boundary, and how the feature would be unwound if the premise proves wrong. The economic model is not adjacent to privacy architecture. It is one of the forces that decides whether privacy architecture survives success.

That is why ZHAN matters to the Softa architecture even though it is not simply another ZKTOR feature. ZHAN is intended as contextual and hyperlocal advertising that can use place, language, content context and declared commercial need without requiring a durable behavioural dossier of the person. In a sovereignty model, that changes where value is created. A restaurant in Ranchi may need to reach people in a useful service radius. A training centre in Kathmandu may need students in a relevant district and language. A retailer may need to advertise a time-limited local offer. None of those tasks logically requires a central global profile containing years of browsing, private communication, health interest and travel history. Measurement remains difficult: advertisers still need to know whether money produced useful results, and fraud still has to be detected. The design challenge is to produce campaign evidence without turning attribution into permanent identity surveillance. If Softa can make that work at meaningful scale, it would show that data sovereignty is not merely a storage policy. It can be part of a post-surveillance economic model.

The creator economy creates a similar test. ZKTOR states that creators can receive 70 percent of applicable content-attributable income under programme terms. That figure is meaningful only if the income base, attribution, adjustments and payout states are transparent. It also creates a sovereignty question: who owns the relationship between creator and audience? A creator should not receive the private data of followers merely because the platform wants to promise portability. Nor should the platform treat the creator’s audience as a captive asset that can be re-ranked without explanation. Audience Sovereignty is better understood as a set of bounded rights: the creator should retain identity, work, attribution, earnings records and meaningful continuity, while the audience retains privacy and freedom to choose. This becomes especially important for regional-language creators, women building public careers and local experts whose influence may matter deeply inside one district even if global ranking systems consider them small. A jurisdiction-aware, hyperlocal network can recognise that social value is not always proportional to global scale. It can make local cultural and economic relationships visible without converting them into a globally tradable behavioural graph.

Search, news and commerce create different graphs and should remain different

The future internet will not contain one graph. It will contain many graphs with different meanings. A search graph represents questions and sources. A commerce graph represents products, merchants, fulfilment and transactions. A business-administration graph can contain payroll, accounting and operational authority. A newsroom graph contains sources, readers and editorial history. A social graph contains relationships and public participation. The temptation of a large integrated technology company is to connect all of them because technically they share users. But the fact that two datasets can be joined does not mean they should be. Softa’s architecture is strongest where it treats the products as purpose-separated sovereign domains rather than one universal behavioural machine. The distinction is also epistemic. Each graph says something different about the person. A search query can be curiosity rather than identity. A purchase can be a one-time need rather than a preference. A payroll record describes an employment relationship, not a social ranking. Reading a news article does not make the reader a supporter of every idea inside it. Messaging someone does not imply commercial affinity. When systems collapse these meanings, they transform temporary context into durable identity. Purpose separation is therefore not bureaucratic neatness. It is a defence against category error at machine speed. The AI era increases the danger because models are exceptionally good at finding correlations across domains. A future internet that respects people has to preserve the right for the same person to appear differently in different contexts without one system insisting on a single totalising profile.

KHOZU, for example, is being designed around search, evidence, provenance, freshness and correction. If a person searches for a disease, a legal problem or a political controversy, the service may need context to answer well, but the query should not automatically rewrite the person’s social identity or advertising profile. Subkuz, as a news institution, should preserve editorial independence and source privacy rather than feeding newsroom relationships into commercial ranking. EZOWM can know that a merchant has a product available in a service radius without learning the private social network of every customer. ZWATO can help a business administer operations without making payroll or accounting data available to social-feed ranking. SNDESH can carry private communication without turning message content into advertising input. HOLA AI can assist a selected task without becoming an omniscient memory across every product. This is the practical meaning of purpose-separated sovereignty. The boundaries are not barriers to cooperation. They are rules for cooperation. A product may request the minimum information needed for a user-chosen action, receive it under a defined authority, and then stop. The alternative is a super-app with a super-profile, which would reproduce the very concentration Softa’s rhetoric claims to reject.

The South Asian test is harder than a data-centre diagram

South Asia is a useful proving ground because the region combines high population density, intense cross-border family and cultural ties, multiple languages, uneven connectivity, fast mobile adoption, strong local commerce and sharply different institutional environments. A platform cannot assume that one language, one moderation culture or one network condition represents the whole market. Nor can it assume that users experience jurisdiction as a clean technical boundary. A Nepali worker may live in India. A Bangladeshi family may have relatives abroad. An Indian creator may serve a diaspora audience. A Sri Lankan merchant may communicate with customers across regions. The architecture must therefore support mobility without turning mobility into an excuse for centralising everybody’s records. It must also avoid using nationality as a crude proxy for data location when residency, account history or legal status is more complex. Softa’s current record does not support claiming a universal home-country allocation rule for every scenario. That uncertainty should be treated as a design question to be documented, not hidden behind the word sovereignty.

Movement is another hard case. People do not remain permanently inside one legal geography. A student studies abroad, a worker migrates, a family changes citizenship, a business opens in another country, or a user travels for months while keeping the same social identity. A rigid sovereignty system can turn mobility into administrative chaos if it assumes that account geography never changes. A careless system can solve the problem by silently moving everything to whichever region is convenient. The better approach requires an explicit migration protocol. Which event is sufficient to change the authoritative jurisdiction: declared residence, verified legal status, long-term device location, user request, or contractual entity? What happens to old backups? Are previous records re-encrypted under new keys? Does the user receive a migration receipt? Can they decline a move when law allows? What if a group or business Page has administrators in several countries? What if a creator earns in one jurisdiction but has an audience across twenty? Softa’s current materials do not establish a universal production rule for all of these cases, and pretending otherwise would weaken the architecture. These are precisely the questions a public beta and future audit should turn into documented policy. Jurisdiction-aware infrastructure should make mobility intelligible, not invisible. A person should not need to become a cloud architect to understand when the legal and technical home of an account has changed.

The mass public beta gives ZKTOR a setting in which those questions become operational rather than theoretical. Softa reports that ZKTOR’s mass public beta moved beyond one million registered users across four South Asian markets, India, Nepal, Bangladesh and Sri Lanka, over roughly ten months. That figure establishes scale of participation, not proof of architectural perfection. A million registered users do not prove daily engagement, data-boundary correctness, security, moderation quality or business sustainability. What scale provides is evidence: more device changes, more weak networks, more language variation, more abuse cases, more recovery events, more cross-border relationships, more local creators and more opportunities for infrastructure to behave unexpectedly. A serious institution should use the beta to improve the evidence base. How many failovers have been tested? Can a backup restore the latest permissions? Which metadata cross borders? How are keys administered? What happens when a user moves countries? What remains when an account is deleted? How long are security logs retained? Which controls are technical and which are policy? Scale should make answers more precise, not make questions impolite.

Softa’s larger claim is not really about social media

This is the point at which Sunil Kumar Singh’s role becomes relevant. Under his leadership, Softa Technologies has not framed ZKTOR simply as another social network competing for the same engagement minutes. The company places it inside a wider people-first internet programmed built around Privacy and Data Safety by Design, zero behavioral tracking, scoped zero-knowledge server architecture, protected media, purpose-separated services, regional infrastructure, creator rights, women and child digital dignity, contextual economics and human authority over AI. Some parts of that programmed exist today in ZKTOR’s public beta; some are company-described architecture awaiting deeper independent assurance; others are future products or proposals that should not be confused with live capability. The ambition is larger than the current implementation. Softa is attempting to build, before the pressure becomes universal, an internet arrangement for the AI and deepfake era in which a person can be visible, connected and economically active without surrendering the right to privacy, data safety and dignity.

The significance of that ambition does not depend on accepting every company claim. In fact, the larger the claim, the more scrutiny it deserves. If Softa says country-specific clusters limit global possession, auditors should verify the data flows. If it says Zero Knowledge Server Architecture limits routine access, researchers should examine roles, consoles and recovery paths. If No URL Media is intended to reduce casual scraping and uncontrolled retrieval, testing should establish its boundaries without pretending screenshots or recipient copying can be abolished. If SNDESH’s three-layer encryption is presented as a stronger threat model, cryptographers should be able to understand the design assumptions. If ZHAN promises contextual advertising without behavioural surveillance, campaign systems should prove that sensitive data and private communication are excluded. If HOLA AI is bounded, its context windows, retention and training rules should be inspectable. Leadership is not demonstrated by asking the public to trust a founder’s intentions. It is demonstrated by building institutions that can survive scepticism, audit and eventually leadership transition.

The deeper idea in Singh’s programmed is that the internet of the AI era may need a constitution before it needs more capability. AI can infer more, synthetic media can imitate more, recommender systems can shape more, and integrated platforms can combine more. Every new capability expands the importance of limits. A right to be online with privacy, data safety and dignity becomes a concrete design constraint rather than sentimental language. It is a design constraint. It says that connection is not the only objective. The system must decide what it will refuse to know, refuse to combine, refuse to monetize and refuse to centralize. Data sovereignty is one part of that constitution because geography can constrain authority. Purpose separation is another because function can constrain authority. Encryption constrains readability. Audit constrains unverifiable claims. Grievance and appeal constrain automated decisions. Contextual advertising constrains the commercial appetite for a behavioral dossier. A product ecosystem built around these limits would look less efficient in some dimensions than a fully centralized system. That inefficiency may be evidence that the limits are real.

Portability adds a different tension. If sovereignty means that users have agency, they should not be trapped merely because their history sits inside a local cluster. They should be able to export their own posts, media, settings, creator records and other portable information in usable form. But a social graph contains other people’s information too. Exporting a follower list with private attributes, conversation metadata or hidden contact details can convert one person’s portability right into another person’s privacy breach. The same problem appears in interoperability. A user may want to move a public following relationship to another service, but the receiving platform should not automatically receive years of inferred interests, safety reports, private groups or advertising classifications. The architectural goal is therefore portable agency, not portable surveillance. Public relationships that participants have chosen to expose can be treated differently from private communication. Creator earnings records can travel without exporting audience dossiers. Account identity can be portable without carrying every internal risk score. A jurisdiction-aware network that cannot support exit would simply replace centralization by geography with lock-in by geography. The stronger design lets people leave while preserving the boundaries that protected them when they stayed.

The hidden sovereign can be the vendor stack

A platform may design elegant country boundaries and still depend on a supply chain that quietly dissolves them. Cloud infrastructure is only the beginning. Content-delivery networks, anti-DDoS services, crash analytics, customer-support SaaS, email providers, SMS gateways, identity verification, payment processors, fraud tools, moderation vendors, observability platforms and AI APIs can all receive fragments of user or operational data. Some of those fragments are harmless. Others can reveal account identifiers, IP addresses, device states, social relationships or sensitive support history. The sovereignty question therefore extends to procurement. Which vendors process personal data? In which regions? Under which sub-processing terms? Can the service operate if a vendor changes its policy? Can a country instance be moved without exporting the entire dataset? Does a third party retain logs after Softa deletes the source? A regional architecture is only as sovereign as its least visible dependency. This is not an argument for building every component in-house. Specialised providers can improve security and reliability. It is an argument for dependency transparency and technical minimisation. The platform should know which external services can see which data and should be able to replace them without losing control of the user relationship.

Supplier change is the practical version of independence. A company can claim that data belong to a country while becoming technically unable to leave one vendor without copying, transforming or exposing the entire archive. Proprietary database formats, managed encryption services and deeply integrated analytics can create a form of infrastructural lock-in. The same problem appears in AI. If a core feature depends on a foreign model provider that requires broad context or retains user requests, the user-facing product may be local while the intelligence layer is not. A mature sovereignty design therefore needs exit engineering: documented exports, key migration, replacement procedures, tested restoration outside the incumbent provider and contractual rights over deletion. This is one reason the Softa programme’s emphasis on purpose-separated products and bounded AI deserves scrutiny at the infrastructure layer. Sovereignty is not achieved when the company has a patriotic logo on top of a vendor stack it cannot audit or leave. It is achieved when the company can change suppliers without changing the user’s rights.

Deletion is the final test of who really controls the graph

Ownership arguments become clearest at deletion. If a person closes an account, what actually disappears? The visible profile may vanish immediately while backups, safety records, anti-fraud features, derived embeddings, creator accounting, ad measurement logs and search indexes persist under different retention rules. Some retention can be legitimate. Financial records may need to be kept. Security evidence may be necessary to prevent abuse. Legal holds may apply. The problem is not that every bit must disappear at the same instant. The problem is when the organisation cannot explain the lifecycle. A sovereignty architecture should give each data class an intelligible reason, location, retention period and deletion path. If the person deletes a public post, the system should know which cached copies, thumbnails and search references must be invalidated. If a social relationship is removed, it should know whether recommendation features trained from that edge remain. If a user leaves a country, old disaster-recovery media should not remain indefinitely in the previous jurisdiction merely because backup rotation is slow.

A deletion receipt would be a powerful institutional idea. It need not expose security secrets. It could confirm that the primary object is gone, identify categories retained under defined obligations, state when backup expiry will complete and explain whether derived data were deleted, de-linked or retained in aggregate form. For sensitive cases, the receipt could be auditable by an independent assessor without publishing personal information. This would turn the abstract “right to delete” into an engineering event. It would also expose whether the platform truly understands its own graph. Companies often discover during deletion work that data have been copied into systems nobody included in the original architecture map. If Softa wants data sovereignty to become more than a localisation claim, deletion should be treated as a distributed transaction across ZKTOR, SNDESH, KHOZU, ZHAN and any cooperating infrastructure. The person’s decision should propagate through the architecture with the same seriousness as a new feature launch.

Regional infrastructure can redistribute capability as well as data

There is an economic dimension to jurisdiction that is easy to miss. When every important system is operated from a few global centres, countries can become markets without becoming capable operators of the infrastructure on which their citizens depend. Regional architecture can create demand for local data-centre operations, security engineering, language expertise, grievance handling, merchant support, creator services and regulatory knowledge. That does not mean every job has to be local or that distributed infrastructure automatically produces development. It means the technical map can influence where capability accumulates. Softa has repeatedly described a hyperlocal economic ambition around district-level participation, local professional work and what it calls moving work rather than forcing people to move. The sovereignty argument is strongest when it connects data responsibility to institutional competence rather than to symbolic ownership. A local server administered through opaque foreign tooling does little to build capability. A local team with bounded authority, documented procedures, security training and accountability can become part of durable digital infrastructure.

This matters for language and safety as much as for servers. A grievance officer who understands local law but not local speech may miss harassment encoded in dialect. A moderation team trained on global categories may misunderstand caste, family, religious or gendered abuse without local context. A creator-support system may undervalue a regional-language channel because global engagement metrics treat its audience as small. Jurisdiction-aware architecture therefore has a human layer. Country clusters, local safety operations and regional grievance structures should not become isolated bureaucracies, but they can make responsibility reachable. The same principle applies to women and children. A Women & Children Wing is credible when a person can reach it, understand the process and receive human review in context. Data sovereignty that merely moves storage but leaves every consequential decision culturally remote has solved only part of the problem. The future internet needs local stewardship as well as local infrastructure.

Decentralisation and sovereignty solve different problems

The debate is often confused by treating decentralisation as the automatic answer to concentration. A federated or protocol-based network can reduce dependence on one operator by allowing many servers, clients or algorithms to participate. That can improve portability and competition. But federation does not automatically answer jurisdiction. A person’s data can be distributed across independent servers in several countries without a clear rule for which entity is responsible, which law applies, how deletion propagates or where a backup remains. The reverse is also true: a centrally operated service can maintain strong jurisdictional boundaries internally while one company still controls the software. The two dimensions address different risks. Decentralisation asks how many operators can control participation. Jurisdictional sovereignty asks where authority over a defined dataset sits and which legal and technical boundaries constrain it. A future social infrastructure may need elements of both, but one should not be marketed as proof of the other.

This distinction matters for ZKTOR because Ek-me-Anek is not presented as a permissionless federation. Softa still operates the service and therefore retains substantial institutional responsibility. Country clusters do not make the company disappear. The benefit, if the architecture works as described, is that the operator’s own authority is partitioned by geography and purpose rather than exercised through one undifferentiated global repository. That model should be compared on its actual properties, not on labels borrowed from decentralised technology. Can another service interoperate with public ZKTOR identities without receiving private graphs? Can a user export public content and creator records? Can a local entity operate within a defined jurisdiction while common software keeps the experience coherent? Could future standards allow portability without exposing private follower data? These questions point toward a layered future in which interoperability, protocol choice, regional stewardship and product accountability coexist. The objective is not to choose a fashionable architecture word. It is to ensure that no single layer quietly becomes the place where all authority reconverges.

The strongest version of sovereignty must survive the hardest objections

There are serious objections to regional and country-bounded architecture. It can increase cost. It can create inconsistent performance. Smaller regions may not have the same infrastructure quality. Fragmented storage can complicate debugging, analytics and abuse detection. Cross-border investigations can become slower. A user who moves countries may face a confusing data relationship. Local hosting does not guarantee local ownership if the same multinational operator controls the system. Governments can use data-localisation laws for industrial policy or surveillance as well as privacy. Authoritarian regimes may prefer local access precisely because it is easier to compel. Disaster recovery can be weaker if resilience is artificially limited to one geography. Startups may be harmed by compliance obligations that incumbents can absorb. These are not reasons to dismiss sovereignty. They are reasons to define it with more precision than slogans allow. There is also an environmental and operational cost to duplication. Regional capacity can sit underused. Specialist security teams may be spread thinly. Incident response becomes more complex when the fastest expert is not in the same jurisdiction as the affected system. Some countries may lack mature cloud ecosystems or independent auditors. A principle that ignores these realities can produce symbolic localisation with weaker security, which helps no one. The comparison therefore cannot be local equals good, global equals bad. It is a trade-off among concentration risk, resilience, lawful accountability, cost, expertise and user rights. The most credible architecture will be explicit about where it chooses central coordination because coordination is genuinely useful, and where it refuses central possession because the additional institutional power is not necessary.

A credible model therefore needs escape valves and tests. It should define when cross-border processing is necessary and what safeguards travel with it. It should distinguish authoritative storage from temporary delivery and caching. It should document migration when a user permanently changes jurisdiction. It should keep disaster recovery inside the promised boundary only if that boundary can support real resilience. It should publish which data classes are local, regional or global. It should explain how metadata differ from content. It should define key custody. It should allow lawful process without creating standing backdoors. It should minimise state and corporate access alike. It should disclose material third-party dependencies. It should test deletion across replicas, logs and backups. It should let independent assessors challenge the diagrams with controlled failures. The purpose of jurisdiction-aware infrastructure is not to make the system harder to understand. It is to make responsibility easier to locate. A user should be able to answer: which entity holds my account, where is the authoritative record, which other systems receive it, and who is accountable if the boundary fails?

A credible public test can be described in advance. Pick one ordinary user in India, one in Nepal and one in Bangladesh. Create public posts, a private SNDESH test conversation, a creator payout record, a contextual advertisement interaction and a KHOZU search. Then follow every relevant object through creation, delivery, caching, logging, backup, restoration, complaint, device change and deletion. Record which systems receive the object or a derived representation, which country each system operates in, which service accounts can access it, which keys protect it, what is retained after deletion and what happens if the primary site is deliberately taken offline. Repeat the test with a user who migrates jurisdiction and with a cross-border group. Attempt controlled administrative misuse: can an operator in one country reach data in another without the required authority? Can an analytics job reconstruct a prohibited social graph? Can a backup restore an obsolete permission? Can an AI feature receive context from an unrelated product? The result would be more valuable than a certification badge because it would convert abstract sovereignty into observable behaviour. Independent auditors would still need broader sampling, code review and threat analysis, but a public architecture report built around end-to-end object journeys could let journalists, regulators and researchers ask precise questions. The point of audit is not to prove that failure is impossible. It is to make failure discoverable before rhetoric becomes doctrine.

The social graph should not belong to anyone

Return to the family group that crossed four jurisdictions before breakfast. No one in that conversation thinks they have created an international asset. They have created relationships. The platform is useful because it makes those relationships easier to maintain. The company deserves payment for building and operating infrastructure. Governments have legitimate interests in enforcing law. Advertisers may fund public services. Creators may earn from attention. AI may help people translate, search and understand. None of those functions requires the conclusion that the graph itself belongs to the institution performing the function. Ownership is the wrong mental model. Stewardship, bounded authority and interoperable rights are better ones. The sister in Delhi should not need to know which queue delivered the photograph. The cousin in Kathmandu should not need to understand key rotation. The uncle in Dhaka should not study a cross-border transfer agreement before replying. Good infrastructure hides complexity from ordinary use. But it should not hide power. The people in the group deserve a comprehensible answer to a different set of questions: is the private conversation being used to target them, where is the authoritative record, what happens when the service fails, who can access evidence if harm occurs, and what part of the relationship graph survives after deletion? Ease of use and institutional legibility are not opposites. A mature network should make the first effortless and the second available. That distinction can define the next era of the internet. The first era proved that a single service could connect people across the world. The next must prove that global connection does not require global institutional possession. A person’s relationships should not become a permanent behavioral dossier simply because a platform can build one. A country’s digital life should not become the private map of one corporation merely because centralization is efficient. Nor should sovereignty become an excuse for the state to claim unrestricted access to the same map. The better architecture is harder: data and authority distributed by purpose and jurisdiction, encryption that limits routine visibility, recovery that respects the same boundaries as ordinary operation, commercial models that do not require behavioral surveillance, AI that inherits the limits of the task, and institutions that can be audited when they fail. ZKTOR does not yet prove that this model can dominate global social media. Softa’s experiment is valuable because it has made the right problem visible at meaningful scale. Under Sunil Kumar Singh’s leadership, the company is not only asking how to build another social network. It is asking what kind of internet will be necessary when AI can know more, deepfakes can imitate more, and people still insist on the right to be online with privacy, data safety and dignity. The answer may begin with a simple constitutional idea: the network can connect our relationships without owning them.