--- title: "Zero-Copy Cloud is Not the End of Lock-In. It i… | Firevault" url: https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026 description: "SAP and Google Cloud have made data migration quietly optional. The data stays put. The operating judgment built above it does not. That is the lock-in the…" lang: en-GB --- Opinion · 29 July 2026 # Zero-Copy Cloud is Not the End of Lock-In. It is the Start of a New One SAP and Google Cloud have made data migration quietly optional. The data stays put. The operating judgment built above it does not. That is the lock-in the architecture diagram will never show. Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Mark Fermor CTO, CMO & Founder, Firevault 4 min read Share Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fzero-copy-cloud-lock-in-opinion-2026 Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fzero-copy-cloud-lock-in-opinion-2026&text=Zero-Copy%20Cloud%20is%20Not%20the%20End%20of%20Lock-In.%20It%20is%20the%20Start%20of%20a%20New%20One%0A%0ASAP%20and%20Google%20Cloud%20have%20made%20data%20migration%20quietly%20optional.%20The%20data%20stays%20put.%20The%20operating%20judgment%20built%20above%20it%20does%20not.%20That%20is%20the%20lock-in%20the%20architecture%20diagram%20will%20never%20show. Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fzero-copy-cloud-lock-in-opinion-2026 Image: A vault sitting still on a dark floor while translucent data streams and AI agent nodes flow above it in cyan and magenta (https://fire-vault.com/__l5e/assets-v1/13d1c397-693e-44a7-b9e6-67b730df160d/zero-copy-cloud-lock-in-2026-2x.jpg) A vault sitting still on a dark floor while translucent data streams and AI agent nodes flow above it in cyan and magenta Why it matters ## What this means for organisations holding critical data _Opinion, by Mark Fermor, Director and Co-Founder, Firevault._ Cloud migrations used to announce themselves. Program offices, weekend cutovers, reconciliation meetings and invoices heavy enough to develop their own weather systems. Everyone knew a strategic commitment was being made because hundreds of people had been hired to make it. On 27 July 2026, SAP and Google Cloud made SAP Business Data Cloud Connect for BigQuery (https://cioinsights.substack.com/p/cloud-data-migration-will-die-soon) generally available. The service creates a bidirectional, zero-copy connection between SAP and Google. SAP tables, metadata and business semantics can be read inside BigQuery without a second physical copy. Gemini can be grounded on live SAP context. Agents can coordinate across Gemini Enterprise and SAP Joule. No extraction pipeline. No parallel warehouse. No three-year migration ending in a dashboard that looks suspiciously like the old one. It sounds like an escape from cloud lock-in. It is not. It moves the lock-in somewhere the architecture diagram will never show. ## The Data Stays. The Judgment Moves. Read the vendor story carefully. SAP remains the system of record. BigQuery becomes the analytical layer above it. Agents interpret the combined context and act across both. The data does not move. What moves is the accumulated answer to a much more consequential question: under these circumstances, what is this company willing to authorise? That answer starts small. Read inventory. Detect a supplier risk. Recommend an alternative. Then it meets the company. Preferred-supplier agreements. Regional approval limits. Material substitutions. Sanctions controls. Freight constraints. Plant-specific tolerances. The executive who suspends normal policy when a production line is six hours from stopping. Every encounter changes the system. A new instruction is added. A tool is connected. An exception is given a route. A threshold is tuned because the original setting escalated everything, or worse, almost nothing. Over months, the company's executable judgment is distributed across agent instructions, semantic mappings, approval policies, identity controls, evaluation data, workflow state, production traces and exception history. All of it sits inside a specific vendor's execution environment. The database can remain exactly where it was. The company's operating judgment cannot. ## Where the Firevault View Fits Firevault has said for two years that data sovereignty (https://fire-vault.com/why-oss/control) is not a storage feature. It is an operating posture. Layer 1 Offline Secure Storage (https://fire-vault.com/offline-secure-storage) exists so that the material that would end a business is not reachable through any always-on API, management port or agentic workflow. That view now needs a companion argument, because the vendors have absorbed the "leave the data alone" line and turned it into a marketing benefit. The new question for a UK board is not "who holds our data". The answer to that question is increasingly "we do, and it does not move". The new question is "who holds the executable version of our judgment". Because if the answer is Google, or SAP, or any single hyperscaler-tied agent runtime, then the exit conversation is far harder than any historical data-migration was. Data has schemas. Judgment has scars. ## Five Questions Before Signing - **Portability of judgment, not data.** Can you export the agent instructions, evaluation cases, exception routes and approval policies in a form another runtime can execute, or only the raw prompts? - **Exit demonstration.** Before a workflow becomes production-critical, insist on a documented replay of the same decision on a second runtime. If the vendor cannot do it in a pilot, they will not do it in a divorce. - **Identity and approval control.** Who owns the identity graph the agents use to act? If it is the vendor, the vendor owns the approvals, not you. - **Sovereign copy of the decision record.** Every agent action should write to a store you control. Not "you have access to". Control. Offline where the stakes justify it. - **The line the agent will not cross.** Which decisions must remain human, in your building, with your people? Write that list before the vendor's onboarding team writes it for you. ## The Line That Matters Zero-copy is a genuine engineering advance. It removes a category of pain that the industry has tolerated for a decade. It does not remove the strategic question. It sharpens it. If the data no longer needs to move, the argument for keeping the most consequential decisions, and the most consequential data, inside your own control gets stronger, not weaker. The right pattern is emerging in outline: sovereign, offline custody of the material that must survive any vendor, coupled with disciplined portability of the operating judgment built above it. That is the posture Firevault was designed for. It is also, in our view, the posture every serious UK board should be asking their CIO to defend by the end of this year. The database can stay where it is. Make sure the judgment can leave. _Source: The AI Decision Brief, "Google Doesn't Need to Move Your Data Anymore", 28 July 2026._ About the author ### Mark Fermor Mark Fermor on LinkedIn (https://www.linkedin.com/in/mfermor) CTO, CMO & Founder Founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. How Firevault would handle this ## Access decided by you, not assumed by the network Control by Firevault removes standing pathways and replaces them with connection windows you approve, so stolen credentials and compromised suppliers have nothing standing to abuse. Get started: https://fire-vault.com/get-started Talk to the team: https://fire-vault.com/demo **No standing access**Paths exist only when you open them **Verification**Identity confirmed before any connection is made **Containment**A compromised account cannot reach what is disconnected **Control**Every window and closure is under your command Related Reading ## You may also find these useful Opinion ### World Backup Day 2026: Backups Are Not Enough Every 31 March, World Backup Day reminds organisations to protect their data. But in 2026, the real question is not whether you back up. It is whether your backups can survive the attack that is coming for them. 31 Mar 2026 5 min https://fire-vault.com/news/world-backup-day-2026-why-backups-alone-are-not-enough Opinion ### Offline by Default: UK 2025 Breaches Survey The UK Government’s Cyber Security Breaches Survey 2025 is a useful reality check for anyone responsible for risk, data, or continuity. Four in ten businesses… 7 Nov 2025 4 min https://fire-vault.com/news/offline-by-default-what-the-uks-2025-breaches-survey-really-means-for-leaders Opinion ### NCSC Annual Review 2025: A Call for Leadership Stop talking about prevention. Start building resilience. The National Cyber Security Centre (NCSC) Annual Review 2025 doesn’t read like a report, it reads… 7 Nov 2025 5 min https://fire-vault.com/news/ncsc-annual-review-2025 Opinion ### Retail Exposure Crisis: Policy Pressure and Breach Wave 2025: When Cybersecurity Became a Political Issue Parliament is asking a blunt question: “Why are UK retailers still leaking customer data?” Major breaches… 23 May 2025 3 min https://fire-vault.com/news/retails-exposure-crisis-policy-pressure-political-fallout-and-the-breach-wave-only-firevault-can-halt Breach Analysis ### Dyfed-Powys Police confirms cyber attack as staff information may have been compromised Dyfed-Powys Police has confirmed that a cyber attack identified on 14 September disrupted non-emergency systems and may have exposed staff information. The force says it has found no evidence that public data was accessed. 25 Sept 2026 3 min https://fire-vault.com/news/dyfed-powys-police-cyber-attack-2026 Industry Insight ### Morgan Stanley email error exposed an internal list of more than 100 potential deals A senior banker accidentally sent clients an internal deal-pipeline attachment. The incident was not a cyberattack, but it shows how one ordinary email can turn confidential working information into a market-integrity and client-trust problem. 25 Sept 2026 6 min https://fire-vault.com/news/morgan-stanley-email-error-deal-list-2026 ## Suggested Reading - What is Offline Secure Storage The foundation of physical disconnection: https://fire-vault.com/how-it-works/offline-secure-storage - Why Offline Secure Storage The case for physical control: https://fire-vault.com/why-oss - Ransomware Defence Hold gold copies offline: https://fire-vault.com/oss-for-ransomware-recovery - Control Physical path control for IT and OT: https://fire-vault.com/solutions/control - Knowledge Vault All articles, guides and whitepapers: https://fire-vault.com/learn/knowledge - Book a Demo See Firevault in action: https://fire-vault.com/demo Back to Knowledge Vault: https://fire-vault.com/learn/knowledge ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026#webpage", "url": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026", "name": "Zero-Copy Cloud is Not the End of Lock-In. It i…", "description": "SAP and Google Cloud have made data migration quietly optional. The data stays put. The operating judgment built above it does not. That is the lock-in the…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/13d1c397-693e-44a7-b9e6-67b730df160d/zero-copy-cloud-lock-in-2026-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Zero-Copy Cloud is Not the End of Lock-In. It is the Start of a New One", "item": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Zero-Copy Cloud is Not the End of Lock-In. It is the Start of a New One", "description": "SAP and Google Cloud have made data migration quietly optional. The data stays put. The operating judgment built above it does not. That is the lock-in the architecture diagram will never show.", "url": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/13d1c397-693e-44a7-b9e6-67b730df160d/zero-copy-cloud-lock-in-2026-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/13d1c397-693e-44a7-b9e6-67b730df160d/zero-copy-cloud-lock-in-2026-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/13d1c397-693e-44a7-b9e6-67b730df160d/zero-copy-cloud-lock-in-2026-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/13d1c397-693e-44a7-b9e6-67b730df160d/zero-copy-cloud-lock-in-2026-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-07-29T10:29:12.053497+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/zero-copy-cloud-lock-in-opinion-2026" }, "inLanguage": "en-GB", "articleSection": "Opinion", "wordCount": 797, "keywords": "Zero-Copy, Opinion, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Opinion, by Mark Fermor, Director and Co-Founder, Firevault. Cloud migrations used to announce themselves. Program offices, weekend cutovers, reconciliation meetings and invoices heavy enough to develop their own weather systems. Everyone knew a strategic commitment was being made because hundreds of people had been hired to make it. On 27 July 2026, SAP and Google Cloud made SAP Business Data Clo", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 } ] ```