The sovereign cloud that isn't: a label for the wrong level | heise online

heise+ entdecken

SuchenAbo

Suchen

Alle Magazine im Browser lesen<br>AnzeigeSpecial: Collaboration im KI-Zeitalter

Newsletter<br>heise-Bot<br>Push-Nachrichten

${lead}

${lead}

${content}

${content}

${content}

${content}

Anzeige<br>Special: Collaboration im KI-Zeitalter

Advertisement

Advertisement

Digital sovereignty has become a sales argument in 2026, moving from a political buzzword. In mid-January, Amazon Web Services launched the AWS European Sovereign Cloud in Brandenburg, its partition fully operated in the EU with separate billing in euros, its personnel, and a separate legal entity under German law. A few weeks later, Microsoft followed suit with “Microsoft 365 Local,” allowing services like Exchange and SharePoint to be run on customer-owned hardware, decoupled from the public cloud. Both offerings carry the same label, and it is a weighty one: sovereign.

Continue after ad

Golo Roden is the founder and CTO of the native web GmbH. He works on the design and development of web and cloud applications and APIs, with a focus on event-driven and service-based distributed architectures. His guiding principle is that software development is not an end in itself, but must always follow an underlying technical expertise.

I consider this label misleading. Not because the technical and organizational measures are worthless; on the contrary, they are considerable. But because they leave untouched precisely the one level that matters for sovereignty. Anyone who wants to understand why a cloud operated in Brandenburg legally remains tied to the United States must first clearly distinguish what “sovereign” can mean. Hardly anyone in the debate makes this distinction, and without it, the participants are talking past each other.

What does sovereign mean here?

Cloud sovereignty breaks down into three levels that are regularly confused. The first is data residency, i.e., the question of where data is physically located. The second is operational autonomy, i.e., the question of who operates, maintains, and, in case of doubt, can access a system. The third is legal sovereignty, i.e., the question of whose law applies in case of conflict and who can issue directives to a provider that it must follow.

These three levels are not equivalent, and that is the crucial point. Data residency and operational autonomy can be established contractually and technically, and this is precisely what the new offerings are doing with great effort. The legal level, however, eludes such measures, as it depends not on the location of the servers but on the jurisdiction to which the parent company is subject.

Videos by heise

mehr Videos

c't 3003

heise & ct

Peertube

A simple thought experiment makes the difference tangible. Imagine all data were located in a data center in Brandenburg, operated by people residing in the EU, encrypted, and contractually secured. As long as the corporation owning this operation is subject to a foreign legal system, that legal system can compel it to take action, and no server location changes that. Data residency is a matter of geography, sovereignty a matter of power.

Continue after ad

This core meaning is not accidental. Sovereignty has always meant the highest decision-making authority, i.e., the question of who has the final say. Applied to the cloud, this means: sovereign is not whose data is in the EU, but who can determine what happens to it in a dispute. Everything else is convenience, not control.

The new offerings in 2026

The AWS European Sovereign Cloud is technically impressive; I don't want to downplay that. It runs as a separate partition with its region, completely separated from other AWS regions, with its identity and billing system in euros, and operations staffed exclusively by individuals residing in the EU. For certification and digital signatures, Amazon has even founded a separate company under German law. There is no cross-regional data traffic to other AWS partitions; even metadata remains within the EU infrastructure.

However, even the details show how sensitive the matter is. Amazon applies the criterion of residence in the EU, while the BSI prefers nationality, and for government contracts and critical infrastructure, this difference can be significant. A seemingly technical detail determines how far the autonomy actually extends.

Microsoft takes a different approach with “Microsoft 365 Local.” Instead of an isolated cloud region, the offering moves the most sensitive services, such as Exchange and SharePoint, back to hardware on the customer's premises, separate from the public cloud. This is essentially a return to in-house operation, repackaged as a sovereignty solution.

Both approaches address real requirements, and for many use cases, they are sufficient. Data residency, operational separation, and traceable access control are not trivial matters. The problem only arises where these...