In my experience, customers who have specific requirements about data sovereignty are also explicitly including backups in those requirements.