EU Sovereign Cloud Services - STACKIT

Short Summary

Organizations adopting EU sovereign cloud services must balance sovereignty assurances with operational realities such as workload support, integration, scalability, and future flexibility. Key risks associated with non-EU sovereign clouds include fragile global supply chains that can disrupt access to critical services, stringent EU compliance obligations (GDPR, NIS2, DORA, the Cybersecurity Act, and sector rules), and the shared-responsibility model where customers remain accountable for lawful and secure usage. Expanded cloud attack surfaces heighten threats from misconfigurations, insecure APIs, compromised identities, and cloud-native vulnerabilities. Even EU-hosted data can face extraterritorial access pressures (e.g., the U.S. CLOUD Act), creating legal uncertainty. Additional challenges include vendor lock-in, the need for provider transparency and auditability, potentially higher costs for sovereign offerings, capability gaps versus hyperscalers (AI, analytics, CDN ecosystems), and shortages of skilled cloud personnel.

The solution frames sovereignty across data/AI, operational, infrastructure, technology, and contractual dimensions. Controls include EU-based datacenters and networks, customer-controlled encryption keys, isolation options (appliances/dedicated environments), independent backups, EU-jurisdiction operations and staffing, regional administrative access controls, EU legal entities with accountable governance, majority EU ownership, and strong control over infrastructure and software artifacts. Technology sovereignty emphasizes open standards and interoperable tooling (Terraform/IaC, REST APIs, OIDC/SAML, portable VM image formats). Contractual sovereignty requires EU governing law, security commitments, transparent supplier/subprocessor controls, predictable pricing and egress terms (“cost sovereignty”), and EU Standard Contractual Clauses.

Use cases concentrate in government, finance, healthcare/pharma, utilities/telecom, and manufacturing/commerce. Selection criteria span service breadth/depth, industry alignment, customer controls (CUECs), openness, outbound migration, and EU legal/operational/infrastructure sovereignty. A vendor spotlight highlights STACKIT’s EU-centered footprint (Germany/Austria), broad IaaS/PaaS and security/AI portfolio, and multiple certifications, while noting fewer specialist services than hyperscalers and the need to verify sovereignty boundaries (metadata, keys, subprocessors, supply chain).

Interesting Facts

• EU regulations cited include GDPR, Directive (EU) 2022/2555 (NIS2), DORA, the EU Cybersecurity Act, and sector-specific rules.
• Foreign legal frameworks cited as extraterritorial risks include the U.S. CLOUD Act.
• Cloud security and compliance responsibilities are shared between the customer and the cloud service provider, with customers responsible for how services are used.
• Cloud environments expand attack surface through misconfigurations, insecure APIs, compromised identities, and cloud-native vulnerabilities.
• Sovereign cloud costs can be higher due to smaller infrastructure footprints, reduced economies of scale, and added requirements like EU-based ownership and certifications.
• Data sovereignty measures include EU-based datacenters/network infrastructure, plus encryption for data at rest, in transit, and during processing with customer key control in the EU.
• Open technical standards cited include Terraform (IaC), REST APIs, OIDC, SAML 2.0, and VM image formats OVA, VHD, and QCOW2.
• STACKIT is a German cloud provider and a brand of Schwarz Digits within the privately owned Schwarz Group.
• STACKIT delivers services from data centers in Germany and Austria.
• STACKIT certifications and attestations listed include ISO 27001, 27017, 27018, and BSI C5 Types 1+ and 2+.

Notable Quotes

• “The responsibility for security and compliance when using cloud services is shared between the customer and the Cloud Service Provider (CSP).”
• “The cloud customer is always responsible for controlling how the service is used, including compliance with laws and regulations.”
• “Cloud environments significantly expand the attack surface for organizations that use them.”
• “Even when data is physically stored within the EU, it may still be subject to access under foreign legal frameworks such as the U.S. CLOUD Act.”
• “Organizations need to maintain flexibility to respond to regulatory changes or geopolitical developments.”
• “Operational sovereignty is achieved by the administration and operation of the cloud service being under EU jurisdictional and organizational control.”
• “Technical guardrails include regional access controls to restrict administrative access to management interfaces and control planes from outside the EU.”
• “Technology sovereignty is achieved by the cloud service being built on widely adopted standards that promote interoperability and reduce vendor lock-in.”
• “Cost sovereignty concerns the ability of cloud customers to understand, predict and control their cloud expenditure without becoming economically dependent on a particular provider.”
• “The strongest sovereignty characteristics also depend on understanding the boundary of the service.”