For years, outsourcing geospatial processing to teams in other countries was the default way to cut costs. Regulatory pressure and data sensitivity are changing that equation.
The regulatory context
Critical infrastructure cartography, cadastre and public administration data are increasingly subject to requirements on where and how they’re processed. Data that leaves the country for processing may stop being a viable option for certain clients, especially in public procurement and regulated sectors like energy or telecommunications.
What the regulations specifically say
No need for a hypothetical: Spain’s National Security Framework (ENS) already governs where and how certain public administration data is handled, and the NIS2 directive extends security obligations to critical infrastructure operators, including much of the energy sector that is a regular client of geospatial services. Add to that the GDPR when personal data is involved (addresses, cadastral ownership). None of these regulations explicitly ban offshoring, but all of them raise the level of justification and control you must be able to demonstrate if the data leaves the territory.
The practical effect is that more and more public procurement tenders and RFPs from large companies include a direct question: where is the data processed? It used to be a technical curiosity; now it can be an exclusion criterion.
The limits of traditional offshoring
Classic offshoring competes on price per operator-hour, but moves the data outside the client’s direct control and adds communication and time-zone friction. For sensitive data, that saving stops offsetting the risk. And there’s a less visible cost: traceability. When data passes through several hands across different jurisdictions, reconstructing who touched what and when becomes much harder to audit.
Automating isn’t just about cutting costs. It’s a way to keep data under control without giving up the efficiency of offshoring.
An alternative with sovereignty
Automating classification with AI and keeping the review operator in the same territory as the data offers a middle path: you gain the efficiency that only offshoring used to provide, without giving up sovereignty over the information. The data never leaves the environment agreed with the client, and the percentage that does need a human eye is reviewed by an operator subject to the same jurisdiction as the data.
This is exactly the approach on which Neobora is built: LiDAR classification and geoprocesses run automatically with AI, and deployment can be done in the cloud or directly on-premise, on the client's own infrastructure, so that the data never leaves the agreed environment. The review and quality control that do require human oversight are performed by an operator subject to the same jurisdiction as the data, on the same platform. There is no need to choose between the efficiency of automation and control over the information: you get both at once.
When offshoring still makes sense
It would be unfair to present this as black or white. For data with no sensitive component — orthophotos of already-public areas, internal projects with no regulated end client — traditional offshoring remains a legitimate and sometimes cheaper option. The question that really matters isn’t "offshoring, yes or no", but "does this specific data need to stay on-territory, and if so, how much is it worth avoiding that risk."
The new balance
The new balance isn’t choosing between cost and control, but using automation so that the cost of keeping data on-territory stops being the main argument against it.
How to evaluate a provider on this axis
Three questions are usually enough to separate marketing from reality: which country are the servers physically located in where the data is processed? Who has human access to the raw data, and under what contract is that person? Can the provider show in writing, not just verbally, where and how each phase of the workflow is processed? If the answer to any of the three is vague, "local processing" is probably just a sales facade.
Neobora is designed to pass that test in writing. On-premise deployment lets you pin down exactly which servers and which territory process each phase; per-project, per-layer and per-user permissions precisely define who accesses the raw data; and the platform's traceability keeps a record of who touched what and when, without relying on multiple hands across different jurisdictions to reconstruct the flow after the fact. It is the difference between local processing that is merely a marketing claim and one that can be audited.
Conclusion
Data sovereignty is no longer just a compliance issue: it is a commercial argument that automation makes viable without sacrificing the margin that only traditional outsourcing used to offer. Neobora exists precisely to put that automation at the service of the data that has to stay within its territory.
