Data sovereignty decides which jurisdiction controls your data. Residency, provider ownership and encryption keys all limit where workloads can run.
Pin nodes, volumes, backups, logs, registries and keys to EU regions, enforce it with admission policies, and block access to the data from outside the EU.
Data residency is where data is stored. Data localization is a rule that it must stay there. Data sovereignty is whose law governs it and who can compel access.
Yes, if the provider is subject to US jurisdiction. The CLOUD Act reaches data in a provider's possession, custody or control, wherever it is stored.
BSI C5 is Germany's catalogue of minimum cloud security criteria. Providers prove it with an auditor's attestation, required for federal and health data.
A sovereign cloud keeps data, operations and legal control in one jurisdiction. Evaluate it by ownership, operator access, key custody, supply chain and exit.
NIS2 is the EU cybersecurity law for 18 sectors. It requires risk management, supply chain security and 24-hour incident warnings. Germany applied it in 2025.
Inventory managed services, map each to an EU equivalent or open-source operator, keep Kubernetes as the constant layer, move data, run both, then cut over.
Yes. GDPR does not ban US providers or require EU storage, but transfers and US access need a basis: the Data Privacy Framework or standard contractual clauses.
Generally no. EU law bars most national localization rules, and German health and tax rules accept EU storage. Germany-only demands usually come from contracts.
The Data Act gives cloud customers a right to switch with at most two months' notice and a 30-day transition. Switching charges are banned from 12 January 2027.
Create a managed Kubernetes cluster in minutes. Every new account gets €200 in credit, so you can explore the full platform with no charge until it's used or expires.