We hold that the work of articulating principles, convening instruments, and reporting on progress must be conducted independently of any State, lest the principles be quietly subordinated to the interests of any administration.
The Initiative is sponsored, custodially and at its founding, by Qosil, Ltd., a private company organized under the laws of the Republic of Kazakhstan and registered at the Astana International Financial Centre. The choice of a private company as the founding custodian is deliberate, and reversible: custodianship may, in time and by majority of the Signatory body, transfer to another entity better suited to its scale.

Qosil is the Founding Organization of the Initiative and the Custodian of the Charter. Its custodial responsibilities include the registration of signatures, the maintenance of the public registry of Signatory States, the recognition of conforming reference implementations, the administration of the annual survey, and the publication of the Annual Report.
Qosil's custodial role is performed in good faith and without commercial self-interest in the recognition function. The company is registered at the Astana International Financial Centre, in the Republic of Kazakhstan — a jurisdiction the company has selected for the substantive seriousness of its data-policy posture and its position between the world's major data-policy traditions.

bRRAIn is a zero-trust, owner-controlled data vault and identity infrastructure, recognized by Article 10.4 of the Charter as one — but not the only — reference implementation of the technical principles of Articles 3 and 5. It demonstrates, in working software, the four inviolable protections: encryption at rest, owner-permissioned access, owner retrievability, and owner retraction with cryptographic verification of destruction.
The identity layer of the bRRAIn vault is the bRRAIn ID Registry, available at id.brrain.io — the surface through which a Data Owner is issued cryptographically-attributed identifiers (for both human users and the autonomous agents they deploy) and authorizes, in real time and revocably, the access of any other party to the contents of the vault. Together the vault and its ID Registry illustrate the open-core sovereignty primitive that anchors the Initiative's technical thinking: the data vault is the canonical surface, the consent and identity layer is the access surface, and every service that consumes user data is a derivative that operates only at the pleasure of the Data Owner.
The reference is offered to Signatory States and to institutions. It is not imposed: nothing in this Charter should be construed to require any State to adopt any particular commercial product. bRRAIn is one possible primitive among many; Signatory States are encouraged to evaluate any open or commercially available system that has been recognized by the Custodian as conforming.
The intellectual core of the Charter rests on a single analogy. The UNESCO Universal Declaration on the Human Genome and Human Rights affirms that the human genome belongs to the person whose body bears it, and is not to be claimed as the property of any State, corporation, or other party. The Charter extends that same protection, in equal force, to the data of that person.
If data sovereignty is a real right, four operational protections must be present in fact, not merely in law. The Charter's Article 3 names them.
The Charter introduces a single cryptographic primitive — the Universal Identifier — by which the actions of any natural person, autonomous agent, or connected device may be unambiguously attributed to a registered, human-attributable owner. The Identifier is designed to preserve the privacy and pseudonymity of its bearer in day-to-day use; attribution is permitted only by the bearer themselves, or, in the narrow circumstances of Article 4.3, by a Signatory State.
The Identifier is the precondition for accountability in an age of autonomous machines. No Autonomous Agent — no artificial intelligence, no robotic system, no Internet-connected device — should be permitted to operate within the jurisdiction of a Signatory State without a registered, human-attributable owner. Personhood is not granted to the Agent; responsibility flows always back to a human or institutional principal.
The vault is the canonical surface; every service that consumes user data is a derivative. This inversion is what distinguishes data sovereignty from data protection: the latter regulates third-party processors; the former structures the architecture so that the third-party processor never holds the keys.
Conventional international indexes publish a country leaderboard. The IDSI does not. The Charter forbids the publication of adverse signals beyond the absence of mention (Article 12.3). The methodological challenge — and the substantive innovation — is to produce an instrument that gives the international community a useful, neutral, transparent picture of progress without ranking States from "best" to "worst."
The Index is structured around five pillars, each weighted equally at twenty percent. Each pillar is derived from one or more Articles of the Charter, and each contains a small set of sub-indicators scored on a 0–10 rubric. Thirty-one sub-indicators in total. The pillar score is the unweighted mean of its sub-indicators; the composite is the weighted mean of the five pillar scores on a 0–100 scale.
Each sub-indicator is scored from a layered source stack: the State's own self-report under the Annual Survey (where signed); open-source data — UNCTAD Cyberlaw, the IAPP supervisory-authority registry, the OECD AI Policy Observatory, the World Bank ID4D dataset, the ITU Global Cybersecurity Index, the Council of Europe Convention 108 list, the Cushman & Wakefield and CBRE data-center datasets, and others; and voluntary third-party attestation from independent reviewers. The Office of the Custodian publishes every per-State entry under a standing Correction Notice protocol — any State may request, in writing, the publication of a corrected entry within thirty days.
The case for the Charter is strongest in the data. Across the world's top 100 data-center-investing States, the correlation between physical investment and the legal-constitutional pillar (Pillar I) is r = 0.352 — moderate-to-weak. The correlation with the technical, identifier, haven, and ecosystem pillars is materially stronger (r = 0.51 to 0.69). The world has built the data-center, ahead of the constitution that should govern it. That gap is precisely what the Charter exists to close.
The Office of the Custodian welcomes corrections to any State's entry, contributions of additional public-source data, scholarly review of methodology, and Founding Member applications from organizations aligned with these principles. The Index, the Charter, and the Initiative as a whole are stronger to the degree that the international community engages with the work.
Write to [email protected]. Use the Correction Notice form supplied at Annex E of Edition 0. The Office of the Custodian commits to publishing a corrected entry within thirty days.
Write to [email protected], or use the form on the Get Involved page. Founding Members are organizations that recognize that the people whose data they receive must remain sovereign over the same.