What is a sovereign cloud and how do you evaluate one?
A sovereign cloud is a cloud service built so that the data, the people who operate it and the legal control over both stay within one jurisdiction, which in Europe usually means the EU. Offerings sold under the label range from an EU region with EU support staff to a provider that is EU-owned, runs EU-developed software and lets customers hold the keys. The European Commission’s Cloud Sovereignty Framework measures that range on a scale from SEAL-0 to SEAL-4.
Sovereign cloud models
| Model | Who operates it | Remaining dependency |
|---|---|---|
| EU-owned public cloud | An EU company with EU staff | Hardware and software supply chain, and any non-EU sub-processors |
| Sovereign offering of a US hyperscaler | An EU-based entity of the US group, with EU-resident staff | The US parent’s ownership and its control over the software and updates |
| Partner-operated cloud on licensed technology | An EU company running a US provider’s technology under licence | The licensor’s software updates and technical support |
| Private cloud or on-premises | You or a contractor | Software vendors, hardware and your own operations capacity |
Examples of the second and third models, described from the providers’ own announcements:
- AWS European Sovereign Cloud became generally available in January 2026 with a first region in Brandenburg, Germany. It is a separate partition from other AWS regions, and AWS says it is operated by EU residents located in the EU.
- Microsoft Sovereign Cloud, announced in June 2025, groups a Sovereign Public Cloud, a Sovereign Private Cloud and national partner clouds such as Bleu in France and Delos Cloud in Germany.
- S3NS, a Thales company that runs Google Cloud technology in France, received the French SecNumCloud qualification for its PREMI3NS offering in December 2025.
These offerings add EU operation and residency. The legal relationship between an EU operating entity and its US parent is the part buyers examine, because US law can reach data that a US company controls. See does the US CLOUD Act apply to data stored in the EU. EU-owned providers are listed in the guide to cloud sovereignty, data residency and portability and in which European cloud providers can run Kubernetes.
How the EU framework grades sovereignty
The Commission first presented its Cloud Sovereignty Framework in October 2025, in a call for tenders for sovereign cloud services for EU institutions. It defines eight sovereignty objectives:
| Objective | What it assesses |
|---|---|
| SOV-1 Strategic | How far the provider is anchored in the EU legal, financial and industrial ecosystem, including ownership |
| SOV-2 Legal and jurisdictional | Exposure to foreign authority and enforceability of rights |
| SOV-3 Data and AI | Where data is processed, how it is protected, and customer control over AI services |
| SOV-4 Operational | Whether EU actors can run and support the service independently |
| SOV-5 Supply chain | Origin and transparency of critical components |
| SOV-6 Technology | Openness and auditability of the stack, and freedom from lock-in |
| SOV-7 Security and compliance | Whether security operations and compliance are controlled within the EU |
| SOV-8 Environmental sustainability | Long-term resilience regarding energy and raw materials |
Each objective gets a Sovereignty Effectiveness Assurance Level. SEAL-0 means the service is under exclusive control of non-EU parties. SEAL-2, “Data Sovereignty”, means EU law applies but material dependencies on non-EU parties remain. SEAL-4, “Full Digital Sovereignty”, means technology and operations are under complete EU control with no critical non-EU dependencies.
In April 2026 the Commission awarded the tender: up to EUR 180 million over six years, split across four contracts. SEAL-2 was the minimum to qualify. Three of the four winning bids reached SEAL-3 and one reached SEAL-2.
National schemes
- SecNumCloud from the French cybersecurity agency ANSSI combines security requirements with protection against non-European law, including conditions on the provider’s registered office, ownership and governance. Under Article 31 of France’s SREN law and its April 2026 implementing decree, French state administrations that put sensitive data in a commercial cloud must use a provider that meets this level of protection.
- BSI C5 from Germany is an audit-based attestation of security controls that also requires transparency about data locations and government requests. See what is BSI C5.
- EUCS, the planned EU-wide cloud certification scheme from ENISA, has not been adopted. Its security requirements were handed to the standards bodies CEN and CENELEC.
How to evaluate a provider’s sovereignty claims
Ask for evidence on each of these points, not a label:
- Ownership and jurisdiction. Who owns the operating entity and its parent, and which countries’ laws can compel either of them.
- Administrative access. Who can log in to production, from which countries, and whether any escalation path leads to staff outside the EU.
- Key custody. Whether you can hold encryption keys in your own KMS or HSM, outside the provider’s control.
- Software supply chain. Who builds and signs the software that runs the platform, and whether a foreign vendor can push updates or withdraw licences.
- Sub-processors. Every company that receives data or metadata, including for support tooling, monitoring and billing.
- Exit. How you get data and workloads out, in which formats, and at what cost. The EU Data Act now regulates switching.
A proof of concept can test some of this directly: revoke the customer-held key and confirm the service can no longer read stored data, review the access logs for operator logins, and restore a backup on another provider.
How Cloudfleet fits
Cloudfleet operates each cluster’s control plane on Google Cloud infrastructure in the control plane region you choose, with all production staff located in Germany, and Confidential Control Plane on Enterprise clusters keeps the encryption keys in your own HSM or cloud KMS. The nodes that run your workloads and store your data can run on European providers or on-premises, including infrastructure qualified under SecNumCloud, through self-managed nodes.