Hybrid & Multi-Location

One sovereign operating model across multiple public sector locations

Government IT environments are inherently distributed. Ministries, agencies, regional authorities, and public institutions often operate across multiple datacenters and jurisdictions, each with distinct legal, operational, and security requirements.

A sovereign government cloud must therefore support hybrid and multi-location architectures by design, without fragmenting governance or control.

This page describes how hybrid and multi-location operation is addressed in a government cloud built on whitesky.

Hybrid as a structural reality

In a public sector context, “hybrid” typically means the coexistence of:

  • multiple government datacenters
  • regional or departmental infrastructure
  • legacy platforms alongside modern cloud environments
  • different security and classification domains

whitesky is designed to operate across these environments without requiring consolidation into a single location or authority.

Multi-location by design, not exception

whitesky treats multi-location operation as a foundational property.

A government cloud can include:

  • multiple physical datacenters
  • geographically separated locations
  • agency-specific environments
  • disaster recovery sites

Each location is explicitly defined, governed, and auditable, while still participating in a unified cloud operating model.

Explicit control over workload placement

In a sovereign government cloud, workload placement is a policy decision.

whitesky enables governments to:

  • define which workloads run in which locations
  • constrain workloads to specific jurisdictions
  • separate environments by agency or classification
  • prevent unintended cross-location placement

Placement decisions are enforced by the platform rather than relying on procedural controls.

Federated governance across agencies

Government cloud environments often span multiple authorities.

whitesky supports:

  • delegated administration per agency or department
  • centralized policy definition with local execution
  • separation between operational and oversight roles
  • consistent governance across independent entities

This enables cooperation without loss of autonomy.

Central policy, local executionA central policy definition applies consistently to all entities. Each agency or department has delegated administration and executes the policy locally. Oversight is a separate role from operation. The result is cooperation without loss of autonomy.Central policy definitionconsistent across all entitiesAgency Adelegatedadministrationlocal executionAgency Bdelegatedadministrationlocal executionDepartment Cdelegatedadministrationlocal executionOversightseparate fromoperational rolesCooperation without loss of autonomy
Central policy, local executionA central policy definition applies consistently to all entities. Each agency or department has delegated administration and executes the policy locally. Oversight is a separate role from operation. The result is cooperation without loss of autonomy.Central policy definitionconsistent across all entitiesAgency Adelegated administrationlocal executionAgency Bdelegated administrationlocal executionDepartment Cdelegated administrationlocal executionOversightseparate from operational rolesCooperation withoutloss of autonomy
Policy is defined centrally and executed locally: each agency or department administers its own environment, and oversight stays a separate role.

Controlled inter-location connectivity

Connectivity between locations must be governed.

whitesky supports:

  • explicit inter-location network design
  • policy-controlled data flows
  • separation between internal and external connectivity
  • auditable network configuration changes

This prevents implicit trust relationships between locations.

Many locations, one operating modelA government datacenter, an agency environment and a disaster recovery site, each with its own isolation boundary and its own workloads. One operating model spans them, with unified access control, central audit and logging, and consistent compliance. Connectivity between the locations is explicit and policy-controlled, and the platform enforces workload placement per jurisdiction.One operating modelunified access control · central audit and logging · consistent complianceGovernmentdatacenterown isolation boundaryVMVMVMAgencyenvironmentown isolation boundaryVMVMVMDisasterrecovery siteown isolation boundaryVMVMVM↔ Inter-location connectivity is explicit and policy-controlledWorkload placement is enforced by the platform, per jurisdiction
Many locations, one operating modelA government datacenter, an agency environment and a disaster recovery site, each with its own isolation boundary and its own workloads. One operating model spans them, with unified access control, central audit and logging, and consistent compliance. Connectivity between the locations is explicit and policy-controlled, and the platform enforces workload placement per jurisdiction.One operating modelunified access controlcentral audit and loggingGovernment datacenterown isolation boundaryVMVMVMpolicy-controlledAgency environmentown isolation boundaryVMVMVMpolicy-controlledDisaster recovery siteown isolation boundaryVMVMVMPlacement is enforced by theplatform, per jurisdiction
Each location keeps its own isolation boundary, while access control, audit and compliance run as one operating model across all of them.

Resilience and continuity across locations

Hybrid and multi-location architectures are often driven by continuity requirements.

whitesky enables:

  • distribution of workloads across sites
  • disaster recovery planning between locations (cross-location restore from backups, and VM replication with third-party tools today; native asynchronous replication is on the roadmap)
  • controlled failover scenarios
  • continuity of operations during local outages

Resilience is designed explicitly, not assumed.

Security and compliance across locations

Security controls must remain consistent even as infrastructure spans multiple sites.

whitesky is designed so that:

  • access control models remain unified
  • isolation boundaries are enforced per location
  • audit and logging remain centralized
  • compliance requirements are applied consistently

Hybrid operation does not weaken security governance.

Relationship to other government cloud topics

Hybrid & multi-location operation builds directly on:

  • Sovereign Cloud Foundations
  • Data Residency & Control
  • Security & Compliance
  • Procurement & Deployment Model

Together, these define a coherent, federated government cloud architecture.

Next steps

  • Identify participating agencies and locations
  • Define jurisdictional and classification boundaries
  • Map workloads to approved locations
  • Design inter-location governance and connectivity