GuidesSecurity

Sovereign Cloud Does Not End at the Server Location

A single German data center does not ensure data sovereignty. Why Sovereign Cloud depends on jurisdiction, operation, key control, and exit.

By Benedikt Langer July 12, 2026 4 min read

Sovereign Cloud Does Not End at the Server Location

Having a German data center on the invoice reassures many procurement departments. But it reveals little about who can access the data in a worst-case scenario. Sovereign Cloud is determined not by the server location, but by four levels above it: law, operations, keys, and exit.

Key Takeaways

Location is only the first of five criteria. The US CLOUD Act allows access to the data of a US corporation, regardless of whether the server is in Frankfurt or Virginia. Jurisdiction depends on the provider, not the hardware.
Key sovereignty is the most powerful lever. Those who control the encryption themselves and keep the keys outside the provider’s reach make any government access technically worthless.
Without an exit plan, lock-in remains. Sovereignty that vanishes into thin air when changing providers is no sovereignty at all. Portability belongs in the contract, not in the fine print.

Why the server location is only half the story

The question of location is justified, but falls short. The decisive factor is the jurisdiction under which a provider operates. A US corporation is subject to the CLOUD Act of 2018. This obligates it to grant US authorities access to stored data by court order, regardless of which country the servers are located in. A Frankfurt data center does not change this legal reality.

Sovereignty is therefore less a question of location than a set of legal and technical guarantees. The server location is the first criterion. It is necessary for GDPR compliance, but is not sufficient on its own. If you stop there when choosing, you confuse data storage with data sovereignty.

Operational sovereignty: Who has administrative access

The second criterion concerns ongoing operations. Who administers the systems, who maintains them, and from which country? Even with a European data center, support can be routed through a global team that theoretically has visibility. Operational sovereignty means: administration and support are handled by staff subject to European law.

Managed Private Cloud models address exactly this point. Operations remain with a European provider, often with a contractually defined group of staff for privileged access. For regulated industries like finance or healthcare, this point is not a luxury, but a prerequisite.

Key sovereignty: the technical worst-case scenario

The third criterion is the most effective lever. If the data is encrypted and the provider does not possess the keys, any government access is futile. Three levels are relevant. Bring Your Own Key means the customer introduces their own keys but manages them within the provider’s environment. Hold Your Own Key keeps the keys in an external system to which the provider has no access. Confidential Computing additionally encrypts data during processing in memory.

For most workloads, HYOK is the pragmatic target state. The effort is higher than with BYOK, but the gain in sovereignty is significant: Without the external key, the data remains unreadable, even if someone obtains physical access to the storage.

Exit and Portability: The Silent Lock-in

The fourth criterion is the most frequently overlooked. A cloud you cannot exit without incurring massive costs creates a de facto dependency. The EU Data Act addresses this by banning excessive switching fees starting in 2027. Still, you shouldn’t rely solely on that: proprietary data formats and vendor-specific services tie you down even without any fees.

Practical sovereignty requires a documented exit path. Which data formats are exportable? How long does a migration take? Which services lack a competitor equivalent? If you only ask these questions when a dispute arises, you have already surrendered your leverage.

The Selection Checklist

Five points transform a marketing promise into a verifiable commitment. You can work through them before signing any contract:

Jurisdiction: Which law governs the provider, not just the server?
Operations: Who has administrative access, and from which country?
Keys: Does key control rest with the customer, ideally as HYOK?
Exit: Is there a documented, affordable exit path?
Proof: Do certifications like BSI C5 or the new C3A independently verify the commitments?

Sovereignty is not a label bestowed by a provider. It is the result of five answers you insist on having in writing. Server location tops this list, but it does not decide the matter alone.

Frequently Asked Questions

What is Sovereign Cloud?

Sovereign Cloud refers to cloud services where data and systems remain entirely under European legal and operational control. The concept encompasses more than just server location: it requires control over the provider’s jurisdiction, administrative access, encryption, and a verified exit path.

Is a German data center sufficient for data sovereignty?

No. The location satisfies GDPR requirements for data storage, but it doesn’t protect against access stemming from the provider’s jurisdiction. A US corporation remains subject to the CLOUD Act, even if its servers are in Germany.

What does the US CLOUD Act mean for European customers?

The CLOUD Act compels US companies to grant US authorities access to stored data upon order, regardless of where that data is stored. Effective protection only emerges when the customer retains the encryption keys themselves, entirely beyond the provider’s reach.

What is the difference between BYOK and HYOK?

With Bring Your Own Key, the customer introduces their own keys but manages them within the provider’s environment. With Hold Your Own Key, the keys reside in an external system with no provider access. HYOK delivers greater sovereignty because the provider is technically incapable of decrypting the data.

How can you independently verify sovereignty promises?

Through certifications. The BSI C5 catalog documents security and operational commitments, while the new C3A procedure makes sovereignty features specifically auditable. Neither replaces your own assessment, but they provide an independent baseline.