Armenia’s Digital Sovereignty
Underground Data Centers and Local Data Requirements
Read the full article
Armenia should build a network of protected underground data centers and require companies providing essential services to maintain usable copies of Armenian operational data inside the country. The objective is clear: transport, payments, healthcare and public administration must be able to function when infrastructure abroad becomes unavailable. The Russia–Ukraine war and the 2026 war in the Gulf make this an urgent national security priority.
A warning Armenia has already received
On 11 October 2026, users in Yerevan were unable to book Yandex taxis or check public transport arrivals following drone attacks on the company’s Russian data centers. Yandex confirmed that attacks between 8 and 11 October shut down its facilities in Sasovo and Vladimir and damaged part of its Kaluga infrastructure. The Armenian head of Yandex had recently put Yandex Go’s domestic audience at approximately one million monthly active users. A war beyond Armenia’s borders had disrupted services used inside our country.
The 2026 war in the Gulf showed how physical attacks can disable major cloud providers. In March, AWS reported direct strikes on two facilities in the United Arab Emirates and damage from a nearby drone strike in Bahrain.
In September, AWS said it could not restore access to resources stranded in its Bahrain region or data hosted exclusively in one UAE availability zone. Physical destruction had produced months of disruption.
Ukraine also demonstrated the value of keeping recovery options abroad. In July 2022, Amazon reported that AWS had migrated 10 petabytes of essential Ukrainian data, including data from 27 ministries and 18 universities, to the cloud. Armenia should combine protected domestic infrastructure with encrypted backup copies in trusted foreign jurisdictions.
Build protection into the infrastructure
Underground data centers are an established engineering model. Norway’s Green Mountain operates its Rennesøy facility inside a former NATO ammunition-storage installation. The operator lists a maximum IT capacity of 25 megawatts and three independent electricity supplies. The example shows that mountain facilities can support commercial computing at substantial scale.
For Armenia, I propose an initial network of at least two geographically separated sites with independent power and communications routes. Underground protection should prioritize civil registries, essential health records, payment infrastructure and public-service platforms. The purpose of building into suitable rock is to shield critical equipment from blast and debris. Geological and cost assessments should determine suitable locations and the protection each facility requires.
Protection must extend to supporting infrastructure and staff access. Earthquake resistance, drainage, fire protection, backup power, cooling and separate fiber routes should be assessed together. Funding should depend on independent engineering review and measurable protection standards.
Require local data and local operating capacity
Companies serving Armenia should have clear obligations for the Armenian data on which essential services depend. Those obligations should begin with finance, telecommunications, healthcare, transport and major digital platforms, and expand according to public importance and scale. Providers should maintain current domestic copies of the necessary data and demonstrate that a defined minimum service can continue when foreign infrastructure becomes unavailable.
A local database must also have the software, computing capacity and authorized access needed to deliver the service. A taxi platform can still stop working if its Armenian servers depend on an unavailable foreign system to authenticate users or dispatch vehicles. This is a dependency that regulation must address.
Regulators should require practical demonstrations: disconnect a provider from its foreign hosting infrastructure in a controlled exercise and verify which Armenian services continue, how quickly they recover and how much recent data could be lost. Recovery limits should reflect the harm an outage would cause. Shared domestic hosting can help smaller providers comply without building their own facilities.
Armenia already has a foundation for this approach. Its cybersecurity law, which entered into force in January 2026, identifies 14 vital sectors and includes physical-security requirements. The next step should be explicit standards for domestic continuity, supported by phased implementation, independent audits and enforceable privacy protections.
At Hayk’s Arrow Armenian Strategic Center, we believe digital sovereignty must be measured by the country’s ability to keep functioning during a crisis. Protected data centers, usable data inside Armenia and tested recovery arrangements should become part of our national security policy. Essential services used in Armenia must have a credible plan to survive in Armenia.