Many companies rely on cloud services as the foundation of their digital infrastructure. At the same time, this approach shifts control over critical business processes and sensitive data. Edward Snowden’s 2013 leaks, changing political circumstances in the US and increasing geopolitical tensions have heightened awareness that technical dependencies can also harbour political risks.
Those who use cloud services not only delegate technical aspects, but also responsibility and, with it, a degree of decision-making autonomy. Sovereignty therefore means not only protecting data, but also retaining the ability to make independent decisions regarding its use, storage and processing.
At the same time, this control often comes into conflict with economic considerations: European cloud alternatives offer greater sovereignty, but frequently fewer services, lower scalability and higher costs than the established hyperscalers. It is important to realise that sovereignty is based on a whole spectrum of control levels. It begins with the legal framework, continues through the technical architecture and must be put into practice in governance processes. There is no such thing as an ‘absolutely sovereign cloud’; every model involves a balance between risk minimisation, scope of functionality and economic considerations.
This article examines the models offered by the hyperscalers AWS, Microsoft and Google for Europe, and how these compare with those of European cloud providers STACKIT, IONOS Cloud, Open Telekom Cloud (OTC) and OVHcloud.
Contents
- Key risk areas
- Hyperscaler models
- The Europeans’ response: sovereignty through ownership
- Opportunities and limitations
- Sovereignty as a risk decision
- Conclusion: Sovereignty is not a binary characteristic
- Outlook: Cloud services in practice
Key risk areas
For European companies, the use of international cloud platforms presents legal challenges. Since the ECJ’s Schrems II rulings (2020) and heightened geopolitical tensions, the legal requirements have become even more specific. Four key risk areas define the framework for action:
- US CLOUD Act: US authorities can require US companies to hand over data, regardless of where it is stored. The EU–US Data Privacy Framework only partially mitigates this issue.
-
Export controls and sanctions: Political or economic measures can lead to the restriction or shutdown of services. Recent developments in technology sanctions highlight the practical relevance of this risk.
-
EU data protection and sovereignty: The GDPR, the Data Governance Act and the Data Act set out obligations regarding data localisation, sharing and control. The NIS2 Directive further tightens cybersecurity requirements for critical infrastructure.
-
Critical dependencies: The Cyber Resilience Act and the EU’s strategic autonomy initiatives are bringing control over digital supply chains into sharp focus.
These four factors help determine whether a cloud architecture is strategically sound and sustainable for businesses. How are the various providers addressing these challenges?
Hyperscaler models
AWS – European Sovereign Cloud
AWS is establishing a fully independent cloud infrastructure within the EU (similar to existing isolated clouds for China or the US military). The “AWS European Sovereign Cloud” is to be operated from 2025 onwards by a European subsidiary, with staff based exclusively within the EU and independent metadata, identity and security services.
The aim is to be able to operate the cloud independently of global networks, even in the event of geopolitical tensions or export controls. AWS describes this capability as ‘operate indefinitely’.
Nevertheless, the parent company remains in the US. Access under the CLOUD Act remains legally possible, even if it is made more difficult from an organisational and technical perspective. Legally speaking, this constitutes a ‘protective shield’, not immunity.
Microsoft – Cloud for Sovereignty and EU Data Boundary
Microsoft is taking an evolutionary approach. Instead of a separate cloud structure, governance and control mechanisms are being integrated into the existing Azure infrastructure.
The ‘EU Data Boundary’ has been in place for Microsoft 365 since January 2023 and for Azure since October 2024, ensuring that customer data is processed only within the EU. In addition, Microsoft has committed to challenging access requests from non-EU authorities through legal channels. Complementing this, national partner solutions such as Delos Cloud in Germany and Bleu in France are emerging, which are operated in accordance with European law.
The approach is legally pragmatic, but technically not decoupled. The governance and management layer remains part of the global Azure structure. In this way, Microsoft reduces the risk, but does not eliminate it.
Google Cloud – Sovereign Solutions with local partners
Google takes a partnership-based approach through joint ventures with European companies. The most prominent example is S3NS in France, a joint venture with Thales designed specifically for French public authorities and critical infrastructure.
At S3NS, Thales operates the infrastructure and bears legal responsibility, whilst Google provides technology and services. Operations are governed by French law, and direct access by Google is contractually prohibited. This model offers a high degree of legal clarity, but is limited to specific target groups and markets and is less comprehensive than the approaches taken by AWS or Microsoft.
The Europeans’ response: sovereignty through ownership
The ‘sovereign cloud’ initiatives of the US hyperscalers seek to erect legal and technical barriers, but ultimately remain subsidiaries of American corporations. European providers are taking a more fundamental approach: they are committed to full ownership and EU jurisdiction from the ground up.
STACKIT
STACKIT is a German company belonging to the Schwarz Group, which operates cloud services in German data centres whilst maintaining full control within the EU legal framework. As part of one of Europe’s largest retail groups, STACKIT has the necessary capital resources to build a sovereign cloud infrastructure. This ensures there is no dependence on US legislation.
IONOS Cloud
IONOS SE is a European public limited company based in Montabaur, Germany. The company operates its own data centres in Germany, France and Spain and controls the entire technical infrastructure itself. This means there is no obligation to grant extraterritorial access under US law.
Open Telekom Cloud (OTC)
The Open Telekom Cloud is operated by Deutsche Telekom AG on Huawei OpenStack, with Deutsche Telekom retaining legal and operational control. The data centres are located in Germany and are subject to German and EU law. Despite the technical partnership with Huawei, data sovereignty remains with a German company, which precludes access under the CLOUD Act.
OVHcloud
OVHcloud is a French company which, as Europe’s largest cloud provider, develops and operates all its hardware, software and infrastructure entirely in-house. With European data centres and a French legal entity, there are no extraterritorial access obligations under US law. OVHcloud embodies the principle of technological independence through complete control of the value chain.
Opportunities and limitations
These companies are not directly exposed to the risks posed by the CLOUD Act, as all operational and data processes are governed exclusively by EU law. However, indirect risks arising from third-party software or international requests for legal assistance may still exist.
The trade-off lies in the scope of functionality: less specialised PaaS and AI services, limited global scalability and lower ecosystem integration compared with US hyperscalers.
Sovereignty as a risk assessment
There is no such thing as an absolutely sovereign cloud. Every model involves a trade-off between risk, functionality and cost. Choosing the right approach depends on which threats a company wishes to prioritise mitigating:
|
Security objective |
Suitable model |
Residual risk |
|---|---|---|
|
Protection against US access (CLOUD Act) |
European providers (IONOS, STACKIT, OTC, OVHcloud) |
Minimal – no US jurisdiction |
|
Protection against export controls/sanctions |
AWS European Sovereign Cloud |
Medium – dependence on US technology remains |
|
Widest range of services and innovation |
Hyperscalers with EU compliance layers |
High – legal uncertainty in the event of geopolitical tensions |
Companies must define which risks they wish to protect themselves against:
-
Legal intervention – enquiries from authorities, court orders, requests for mutual legal assistance
-
Political influence – export controls, sanctions, diplomatic tensions
-
Technological dependence – vendor lock-in, critical infrastructure components, supply chains
-
Economic risks – pricing, market power, strategic business decisions
The selection of a cloud solution is therefore a strategic element of the overall architecture. It forms part of the same risk analysis as availability zones, backup strategies or disaster recovery – and should be assessed systematically accordingly.
Conclusion: Sovereignty is not a binary characteristic
Sovereignty does not arise from certificates or location commitments, but from control over ownership and operations. US hyperscalers can simulate this control through technical and organisational measures, but cannot fully guarantee it due to their corporate structure. European providers, on the other hand, offer greater legal certainty through EU ownership, but have functional limitations.
Companies must decide which threats they actually wish to mitigate:
-
Anyone wishing to prevent access by foreign authorities has no choice but to opt for European providers.
-
Those wishing to protect themselves against export controls or political tensions can opt for the hyperscalers’ sovereign models or hybrid models.
-
Those who prioritise innovation and global scaling must inevitably accept a higher residual risk.
In practice, many companies adopting a hybrid approach rely on multi-cloud architectures that store critical business data and personal information in EU clouds, whilst analytics, AI workloads and global services are hosted by hyperscalers. This does not solve the sovereignty issue, but rather shifts it to the architectural level. Without clear data classification (e.g. ‘public’, ‘internal’, ‘confidential’, ‘restricted’) and defined interfaces, this creates more complexity than security. Additional challenges here include increased operating costs due to multiple platforms and data transfers, more complex identity and access management, greater difficulty in demonstrating governance and compliance, and the risk of shadow IT where responsibilities are unclear.
The key insight: sovereignty is not a binary characteristic, but a spectrum of control levels. It begins with the legal framework, continues through the technical architecture and must be put into practice in governance processes.
The choice of cloud strategy is therefore a fundamental business decision that encompasses legal, technical and economic dimensions in equal measure. It belongs in the boardroom, not just in the IT department.
Outlook: Cloud services in practice
The foundations for compliance have been laid, but what about practical implementation? In the second part of our ‘EU Sovereign Cloud’ series, we analyse the specific feature sets of IONOS, STACKIT, Open Telekom Cloud and OVHcloud incomparison with Microsoft Azure. We assess the portability of common cloud services and highlight where European providers can compete and where critical gaps arise.
Do you have any questions or need assistance?
Are you defining the optimal path for your business and securing your digital sovereignty? As an experienced partner, we’ll help you navigate this complexity, make the right decisions and successfully implement your bespoke cloud strategy. Contact us or find out more about cloud transformation on our website.
The authors
|
Rüdiger Heins
As a Senior Software Architect at iteratec, Rüdiger brings over 15 years of cross-sector experience from the games, manufacturing, e-commerce and logistics industries. He is an expert in cloud computing and cloud transformation on AWS and Azure. He also specialises in bespoke software development, IT modernisation and cyber security. Rüdiger actively shares his knowledge through talks on topics such as API gateways & OAuth, SecureCodeBox, continuous penetration testing and application monitoring. |
|
Yves Schubert Yves Schubert works as a Senior Software Architect at iteratec. In this role, he works as a full-stack developer on numerous projects, whilst also delivering training courses and lectures on DevOps, quality assurance and back-end development. In his work, he applies the principles of software craftsmanship. |
|
Christopher Tröger Christopher is a Senior Lead Software Architect at iteratec and specialises in cloud architecture and cloud transformation, with a focus on Microsoft Azure (Certified Azure Solution Architect) and STACKIT. He develops scalable cloud-native solutions for enterprise clients and drives forward modern cloud strategies and best practices internally. |
