Sovereign cloud: what to really check before you move your data anywhere

• There is no certification for a sovereign cloud. You test it yourself, using the questions in this article.
• A sovereign cloud is about control: can you always reach your data, can you switch providers when you need to, and can no other party shut off your service or access your data? Data location and ownership of the provider are part of that.
• NIS2 and the GDPR remain your responsibility. A provider can help you, but does not take that responsibility over.

Many providers tell you your data sits in a Dutch or European data center. That is often true, and you can easily verify it. But it says little about who can technically access your data and how easily you can leave.

Three layers play a role here. Where your data is physically located. Who owns the provider and which legal system that company falls under. And how the service is built: where does the management environment run, who holds the encryption keys, and does the provider use a third party’s infrastructure under the hood?

That third layer is the one most often skipped. Yet it determines how much weight the other two carry. Take the American CLOUD Act. It can require providers that fall under US law to hand over data they own, manage or control. If a provider cannot technically access your data, because you manage the keys and no external management environment sits in between, there is little to hand over. If the management platform falls under US law, that law can still reach your data, even if the servers are in the Netherlands. That does not have to be a problem, as long as you weigh it consciously.

Also watch for a kill switch. Can a vendor shut off your service, for example through a license check that fails when the connection drops? Then control does not lie with you, whatever the contract says.

Wondering which European providers fall outside the CLOUD Act? Look at ownership and architecture. Ask both questions directly and get the answer in writing.

NIS2 and the GDPR are rules for your organization. A provider can make compliance easier or harder. The legal responsibility stays with you, as data controller or as an essential or important entity.

Where a provider does help:

• Data residency within the EU, laid down in the contract.
• Notification deadlines for security incidents that match what NIS2 expects from you.
• An up-to-date list of subprocessors, so you know who else can access your data.
• Logs, access records and reports you can hand to your own auditor.

Does a provider say it makes your organization compliant? Then ask it to explain exactly what it means by that.

Run through these questions with every provider, including your current one.

Do you stay in control?

1. Can you get your data out in a usable format, without a penalty? Ask what switching costs, in time and money.
2. Where does the platform that manages your environment run? If it runs at a third party, you have a dependency that is hard to get rid of later.
3. Who manages the encryption keys? If the provider does, find out under which legal process it can be forced to hand them over.
4. Can anyone else shut off your service, for example when a license expires or a connection drops? Check how the service behaves in that case.

Does the rest of the picture hold up?

1. Does the provider use a hyperscaler’s infrastructure under the hood? Then the four questions above come back one layer deeper.
2. Who owns the company and where is it registered? The commercial register or the provider’s own press releases will tell you.
3. In which data centers exactly does your data live? Have the locations written into the contract, because “in Europe” is too vague.
4. Which certifications does the provider hold, such as ISO 27001, SOC 2 or PCI DSS where relevant? Request the certificates themselves and read the scope.
5. Has the provider ever received a request from a foreign government, and what does the process look like when that happens?

This is the same due diligence you do for any supplier that handles sensitive data.

Considering a move away from AWS or Azure? Then also read European alternative to AWS: how a SaaS scale-up builds a resilient cloud strategy.

Most organizations only look into this when a customer, auditor or regulator asks. Then it turns into a scramble. Do it now, with your current provider too, and it takes you an afternoon. During an audit it costs you far more.

It also helps in negotiations. How a provider responds to these questions says a lot about how it works. A clear, written answer is a good sign. If it dodges the question, factor that into your decision.

Worldstream is a flexible, transparent and local alternative that fits within a resilient cloud strategy. We are a Dutch company with our own data centers in Naaldwijk and our own network, and who owns us is public. We keep the entire infrastructure chain in our own hands: data center, network, hardware and support. You work with fixed monthly prices, based on what you agree with us. So you know what you pay for and there are no surprises on the invoice. Our engineers are on site 24/7 in our own data centers, and the average support response time is 7 minutes.

You can expect a concrete answer like this from any provider. If a provider cannot give a number, location or document, that is a reason to keep asking.

Pick your current provider or the one you are considering. In one afternoon, find out who the owner is, where your data lives, where the management environment runs, who holds the keys and what the contract says about exit and data requests. Write the answers down.

Can’t work it out yourself? Then put the questions directly to the provider and note how fast and how concrete the answer is. Want to go through the list for your own environment with us? Get in touch, we are happy to think along.