Most AI adoption in Indonesia today is, at bottom, renting. An institution uses a service whose model runs in a foreign provider’s data center, and sends its data there to be processed. For many purposes that is reasonable and practical. For public-sector work and sensitive data, though, it carries a dependency that rarely gets discussed.
That dependency is usually waved away with a single reassuring line: “the data is stored in-country.” The large providers do offer local regions, and many people treat the question of sovereignty as settled there. Yet the location of the server is the easy part of the problem.
Legal control, not physical location
What matters is not where the data physically sits, but whose law governs it. The United States has a statute called the CLOUD Act. It lets US authorities compel a provider under their jurisdiction to hand over data, regardless of which country that data is stored in. A server in Jakarta owned by a US provider is therefore still within reach of US law.
Sovereignty, in the end, is about control, not coordinates. A data center inside the country, operated by a party that answers to foreign law, does not make your data sovereign. It only makes it feel closer.
Three layers of control
If location is not the measure, what is? At least three layers need to sit under domestic control before an AI system deserves to be called sovereign.
The first is the model weights. The model you use has to be something you can hold and run yourself, not a black box reachable only through a call to someone else’s server.
The second is the runtime and the hardware. Inference has to run on machines you control, with nothing sent out along the way. The moment a single outbound call is needed to serve a request, control has already leaked.
The third is the operator. Whoever runs the system has to answer to Indonesian law, not to a foreign court order.
Sovereignty is layered and graded, not a switch that is simply on or off. But those three layers are what separate “runs in-country” from “genuinely under your own control.”
On the capability objection
The most common objection is that a homegrown model is bound to lose to a frontier model. For general use, there is something to that. The largest models really are stronger at open-ended conversation.
Public-sector work, however, is rarely open-ended conversation. It is interpreting regulation, reading official documents, and following specific procedures. On that ground, a general model of any size often misses, because it was never formed in the context. A smaller model that genuinely knows the regulations, the document formats, and the Indonesian register can be more useful than a far larger general one. This is where a domestic effort makes sense: by mastering the domain that matters, not by chasing size.
How we do it at Epithre
Epithre runs its whole AI stack on hardware we operate ourselves in Jakarta, from the runtime up to the applications. Strata, our model for government work, is this principle put to work directly: trained on Indonesian regulation, run inside national jurisdiction, with nothing sent out during inference.
We will not pretend the choice is free. Running your own stack means carrying the infrastructure and its upkeep, and that is a real burden. But for work whose control must not change hands, the burden is worth it. Sovereignty is a choice with a cost, and we think it is a cost worth paying in the right place.
