Retail and small-business banking runs on a small number of mostly US suppliers, with cloud and log-in the most exposed layers. But the everyday payment rails are genuinely UK-run, and core-banking software has real UK and European choices — Thought Machine, Mambu, Finova.

The systems holding patient records and running clinical care sit largely with US-controlled suppliers, on US cloud and under US legal reach — the most sensitive data in the country. Some UK-controlled clinical systems exist, but the most critical layers are foreign-controlled and close to un-substitutable.

Autodesk’s near-monopoly on design and building-information-modelling is the deepest dependency, with no UK alternative at scale. The operational layers — project and commercial management, property and facilities — are the bright spot, with genuine UK-controlled options.

A farm does not own its most valuable data: connected machinery and telematics lock field and machine records to the equipment maker, behind a closed platform. UK-controlled options exist at the farm-records layer, but the data the farm cannot move is the most foreign-locked of all.

A law firm’s most confidential asset — privileged client work and decades of case files — lives with mostly US-controlled suppliers, reachable under US law; even the document system often runs on Microsoft’s cloud. The legal-AI layer carries the sharpest confidentiality risk. The clear exception is the firm’s own banking.

A typical mid-size financial firm runs on a handful of mostly US-owned suppliers — and roughly two-thirds of the critical parts trace back to Microsoft alone. There is no easy way to switch the core layers. The brightest spot is the firm’s own banking, under UK law.

The policy-administration and underwriting engine an insurer trades on is US-dominated and holds the most sensitive data on the profile. The broking layer is the exception — PPL is UK-run, and Acturis runs its own UK and Amsterdam data centres.

The software that runs the live production line, and the firm’s crown-jewel product designs, both sit with foreign-controlled suppliers and under foreign legal reach. Only the firm’s banking is genuinely UK-controlled.

Adobe’s near-monopoly on creative tooling, with proprietary file formats, is the deepest lock-in; the strongest UK-origin product, Affinity, is now Australian-owned. UK-controlled options are thin exactly where they matter most.

Several market leaders councils think of as British are foreign-owned — Civica, NEC, Idox — and the most sensitive data, children’s social care, sits in that group. Genuine UK-controlled and UK-government options exist; the substrate concentrates on two US clouds.

The e-commerce platform and the payments rail are both foreign-controlled and business-critical. UK-controlled options exist at the platform and till layers, but the US card schemes are unavoidable.

For the most popular packages the whole client ledger sits under foreign control, even as Sage, IRIS and FreeAgent offer genuine UK-owned options. UK ownership of the vendor is not the same as UK control of the data — the cloud beneath is American.

The investment platform and back-office administration — the two layers a wealth firm runs on — are foreign-controlled and concentrated in SS&C and FNZ. UK-controlled options exist at the adviser and planning layer.

Card payments and the electronic point-of-sale till decide whether the business can trade, and both are foreign-controlled — the US card schemes unavoidable. UK-controlled options are real at the till and booking layers.

Fleet telematics streams live vehicle and driver location to foreign owners as a closed black box — the sharpest exposure in the sector. The transport-management layer is the UK soft spot, with genuine British supply.

Donor data sits with the US-controlled fundraising leaders, and one US supplier can span both the donor database and online giving. Unusually, strong UK-controlled challengers exist — Donorfy, Beacon, Enthuse.

Children’s safeguarding records sit with the US-controlled market leader, and the cloud, office software and log-in cluster on Microsoft or Google. But the pupil-database layer that defines a school has genuine UK-controlled leaders — Arbor and Bromcom.

Billing and customer-information-system lock-in is the defining risk, but this is the first sector with a genuine UK-controlled leader at its defining layer — Kraken. Cloud, identity and the substrate beneath remain US-dominated.