This paper examines how technical architecture enables data sovereignty over shared data, in commercial platforms, with a focus on the critical challenges posed by Internet of Things (IoT) data flows. Analysing four EU-based platforms (TomTom, Dawex, Skywise, Nallian) from the European Commission's 2018 study on business data sharing, we investigate how technical mechanisms operationalise sovereignty where contractual governance faces limitations of scale, speed, and complexity. Through cross-case analysis applying Lawrence Lessig's "Code is Law" framework, we identify distinct architectural enforcement patterns across the platforms. TomTom's API-centric model achieves preemptive control by terminating misuse in milliseconds, enabling real time intervention. Dawex's blockchain-backed policy engine enables dynamic governance, translating licensing terms into executable cross-border constraints. Skywise's access silos structurally contain data usage, making unintended reuse architecturally implausible through purpose-bound design. Nallian's rights-granting engine delivers granular sovereignty, enabling field-level control. From these findings, we develop a four-mode Architectural Sovereignty Framework, conceptualizing enforcement mechanisms along two dimensions: timing (real-time vs. ex-post) and resolution (macro-level structural vs. micro-level granular). The framework identifies Preemptive, Adaptive, Structural, and Granular sovereignty as distinct modes through which code operationalises control in IoT data sharing contexts.