European cloud and digital sovereignty

Working in Germany, I've noticed a change over the last few years. Questions that used to come only from legal teams now come from CTOs, CEOs and customers: Where exactly is our data? Who can access it? What happens if a foreign government demands it? Could our cloud provider be forced to cut us off?

That's digital sovereignty. Now it's a real factor in infrastructure decisions for European companies, not just a niche topic.

Why it's in the news

A few forces are pushing it:

• Legal tension. US laws like the CLOUD Act can require US companies to provide data they control, even if it's stored in Europe. That conflicts with GDPR's protections. The EU–US Data Privacy Framework currently allows transfers, but its predecessors were struck down by courts twice, and many companies don't want to bet on it lasting.
• Geopolitics. Recent years have made people more aware of dependencies on foreign technology and the risk of political decisions affecting access to services.
• Regulation. NIS2, DORA (for financial services), the Data Act, the Cyber Resilience Act and sector rules increasingly ask companies to manage risks from technology providers, including concentration risk and exit strategies.
• Public sector requirements. Governments and public bodies in several countries prefer or require sovereign solutions.

What "sovereignty" actually means

It's a fuzzy word. It usually covers three layers:

1. Data sovereignty: data stays in a specific jurisdiction, and you control who accesses it.
2. Operational sovereignty: the people operating the infrastructure are in the EU, subject to EU law, and foreign access is technically and contractually prevented.
3. Technological sovereignty: you can keep running, and move, even if a provider becomes unavailable. This often means open standards and open source.

Different requirements need different levels. A small e-commerce site and a hospital have very different needs.

Sovereignty isn't about where the server stands. It's about who can switch it off, and who can look inside.

The hyperscalers' answers

The big US providers have responded with sovereign offerings:

• AWS European Sovereign Cloud: a separate cloud infrastructure in the EU, starting in Germany, operated by EU-resident staff and independent from other AWS regions.
• Microsoft: the EU Data Boundary, plus sovereign cloud offerings, including partnerships with European operators.
• Google Cloud: sovereign options with local partners, such as offerings operated with T-Systems in Germany and with Thales (S3NS) in France.

These aim to combine the hyperscalers' service catalogue with stronger European control. Whether they fully address the legal concerns is debated, and depends on the specific setup.

The European providers

There's also a growing group of European cloud providers:

• OVHcloud (France): a broad IaaS and PaaS offering, with SecNumCloud-qualified options.
• Hetzner (Germany): very cost-effective servers and cloud, popular with startups and developers.
• Scaleway (France): developer-friendly cloud with managed Kubernetes and AI infrastructure.
• STACKIT (Germany, Schwarz Group): built for sovereign enterprise needs.
• IONOS (Germany), Open Telekom Cloud (Germany), UpCloud, Exoscale and others.

Their strengths: EU jurisdiction, often lower prices for raw compute and bandwidth. The trade-offs: fewer managed services, smaller ecosystems, and sometimes less mature tooling.

Initiatives like Gaia-X and the IPCEI-CIS project aim to create common standards and federated European infrastructure, with mixed progress so far.

What changes in the architecture

If sovereignty matters to you, a few architectural choices help regardless of provider:

• Kubernetes and open-source building blocks (PostgreSQL, Kafka, object storage with S3-compatible APIs) make it easier to run on European providers or move between them.
• Encryption with keys you control, ideally in your own HSM or an external key manager, so the provider can't read your data.
• Infrastructure as code for everything, so you can rebuild elsewhere.
• Data classification: not all data needs the same protection. Put the sensitive part in a sovereign environment and keep the rest wherever it's most practical.
• A tested exit plan: regulators increasingly expect it, and it's good engineering anyway.

Migration considerations

Moving from a hyperscaler to a European provider is mostly a question of managed services. Plain VMs and Kubernetes move relatively easily. Proprietary databases, serverless functions, queues and AI services don't. Expect to replace some managed services with open-source equivalents you operate yourself, or with the provider's offering.

A hybrid approach is common: sensitive workloads and data on a sovereign platform, the rest on a hyperscaler.

So, should you care?

If you're in Europe and handle sensitive data, work with the public sector, or are in a regulated industry, yes. Even if you're not, keeping your architecture portable with open standards and holding your own encryption keys is cheap insurance.

My take: sovereignty isn't about rejecting American clouds. It's about making sure you always have a choice.

— Desly