Our view of data sovereignty
Sovereignty has levels. You set the measure.
Data sovereignty means deciding for yourself, and being able to show, where your data is stored, who can access it and how you get it back out. How much of it you need is not a matter of principle. It depends on your data, your obligations and your dependencies. We work it out with you and put it into practice.
Three levels
Three levels, three different questions.
The European Union asks how independent Europe is from the laws and technology of other states. Germany adds its own assessment standards and duties for particular sectors. Your company asks something else: whether you decide what happens to your data, and whether you can switch providers when you want to.
| Level | What it is about | Where it shows |
|---|---|---|
| European Union | Europe's independence from the laws and technology of other states | data protection law, rules for cloud services, the European Commission's sovereignty levels for its own procurement |
| Germany | national security interests and sector-specific duties | BSI criteria for cloud security (C5) and for autonomy (C3A); requirements for health data, bookkeeping and professional secrecy |
| Your company | freedom of choice towards every single provider, European ones included | knowing where data is stored; keys and contracts in your own hands; a tested way out |
The levels build on one another. An offering that meets the EU's requirements is therefore not automatically right for your company. Conversely, a service without a European link can be a reasonable choice for data without special protection needs, provided you make that choice deliberately and can always get out again.
Operating models
Location alone says little.
A data centre in Frankfurt does not answer the important questions. Under US law, for example, providers must hand over data they control, wherever it is stored. What counts is who operates, whose law applies and who holds the keys. Four operating models, five questions:
| Public cloud from an EU provider | “Sovereign cloud” | Private cloud | On-premises | |
|---|---|---|---|---|
| Who operates? | the provider, on infrastructure shared by many customers | a provider with specific commitments, for example on the operating company, staff or location | a service provider or you, for your company only | you, on your own premises |
| Whose law applies? | that of the provider's ownership and control chain | that of the operating company and, depending on the set-up, of the technology supplier | that of the operator | that of your location |
| Who has access and keys? | governed by contract and key management | usually the core of the commitment; check the details | depends on who operates | you and whoever you engage |
| How do you get out? | via open formats and export paths; proprietary services make it harder | as with the public cloud | easier if platform and formats are in your hands | data and systems are with you |
| What do you need to be able to do? | selection, contracts, exit planning | plus checking the commitments | steer the operator or run it yourself | operations, updates, backup, emergencies |
“Sovereign cloud” is a market label. What an offering delivers only becomes clear when it is checked: Who controls the operator? Does the service keep running if the technology supplier stops updates or licences? Who holds the keys? Is there a tested way out? Public standards for this are emerging, such as the European Commission's sovereignty levels and the BSI's C3A catalogue.
Private cloud and on-premises are often confused. Private cloud describes who the infrastructure is provided for: exclusively for one organisation, with the characteristics of a cloud. On-premises describes where it is, namely on your own premises. A private cloud can therefore also run at a service provider, and not every in-house server room is a private cloud. If you run it yourself, you need your own skills for updates, backup and emergencies. Those skills are part of sovereignty too.
Your measure
What sovereignty means for your company.
Hardly any company needs the highest level for all of its data. For critical data, however, you should choose the level deliberately and be able to show why. Five questions help:
- Which data is critical, for example design data, customer data, personnel data or trade secrets?
- Which obligations apply from law, your sector and customer contracts?
- Which providers do you depend on, and what would switching cost?
- What can you run yourself, and what do you want to run yourself?
- Which residual risk do you accept deliberately?
The result is an allocation for each data set: what may go to the cloud, what belongs in Europe and what stays in-house.
Where we stand
We work at the level of your company.
The EU and Germany set the framework and provide assessment standards. We work out the right degree of sovereignty with you, implement it and, if you wish, operate it.
Your area of responsibility.
You decide where your data is stored and who can access it, and you can change that decision at any time. Every recommendation we make is aligned with this.
Only what enables sovereignty.
Sovereign Data Systems GmbH only provides products and systems that give you data sovereignty. What that looks like differs from product to product; the goal is the same.
Independent.
We assess independently. We name our own products openly in our consulting, and you can opt out of them. We rely on open formats and documented ways out.
Where do you stand today?
You can answer the five questions above on your own. If you want to do it systematically and with evidence, we start with an assessment: eight control dimensions, a scorecard, a management summary and a roadmap.