From dbe0b45c98e14af52ca96f4b1b72a7cff2cc475d Mon Sep 17 00:00:00 2001 From: Cyril Roos Date: Thu, 23 Apr 2026 15:48:53 +0200 Subject: [PATCH 1/6] add criteria and selection for european sovereign cloud --- radar/2026-04-23/european-sovereign-cloud.md | 92 ++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 radar/2026-04-23/european-sovereign-cloud.md diff --git a/radar/2026-04-23/european-sovereign-cloud.md b/radar/2026-04-23/european-sovereign-cloud.md new file mode 100644 index 0000000..da02ea1 --- /dev/null +++ b/radar/2026-04-23/european-sovereign-cloud.md @@ -0,0 +1,92 @@ +--- +title: "European Sovereign Cloud" +ring: trial +quadrant: platforms-and-operations +featured: true +--- + +European Sovereign Cloud refers to cloud infrastructure operated by European providers, subject exclusively to EU jurisdiction, and designed to guarantee full digital sovereignty. As geopolitical tensions and extraterritorial legislation (such as the US CLOUD Act and FISA Section 702) create uncertainty around data processed by non-EU cloud providers, the need for genuinely sovereign alternatives has become a strategic priority — particularly for organisations handling sensitive data or operating in regulated sectors. + +### Why European Sovereign Cloud? + +- **Digital Sovereignty:** Ensures that data, infrastructure, and operations remain entirely within EU legal jurisdiction, eliminating exposure to non-EU government access requests. + +- **GDPR & Schrems II Compliance:** Following the Schrems II ruling, transferring personal data to US-based providers carries inherent legal risk. European sovereign cloud providers eliminate this concern by design. + +- **Regulatory Alignment:** Sectors such as government ([BIO](https://www.digitaleoverheid.nl/overzicht-van-alle-onderwerpen/cybersecurity/kaders-voor-cybersecurity/baseline-informatiebeveiliging-overheid/)), healthcare ([NEN 7510](https://www.nen.nl/nen-7510-1-2017-nl-238898)), and finance increasingly require or strongly prefer data processing within EU borders by EU-controlled entities. + +- **Reducing Strategic Dependency:** Reliance on a small number of US hyperscalers (AWS, Azure, GCP) creates concentration risk. Diversifying towards European providers strengthens organisational resilience. + +- **GAIA-X & European Cloud Initiatives:** The [GAIA-X](https://gaia-x.eu/) initiative promotes interoperable, transparent, and sovereign data infrastructure across Europe. Selecting providers aligned with these principles future-proofs the investment. + +### Key Selection Criteria + +When evaluating a European sovereign cloud provider, the following criteria are essential: + +- **EU Ownership & Jurisdiction:** The provider must be an EU-registered entity with no controlling interest by non-EU parties. This is the foundation of true sovereignty. + +- **OpenStack or Open API:** An open, standardised API — preferably [OpenStack](https://www.openstack.org/) — significantly reduces vendor lock-in. OpenStack is the de facto open standard for cloud infrastructure and enables portability across providers. + +- **Managed Kubernetes:** A mature, managed Kubernetes offering (or equivalent container orchestration) is critical for modern application deployment and operations. + +- **Comprehensive Service Catalogue:** Beyond compute and storage, look for managed databases, object storage, load balancers, DNS, backup services, VPN/networking, and monitoring. + +- **Infrastructure as Code Compatibility:** First-class support for [Terraform](/tools/terraform) / [OpenTofu](https://opentofu.org/) providers is essential for automation and reproducibility. + +- **Certifications:** ISO 27001, SOC 2, and — depending on context — NEN 7510 (healthcare) or BIO (Dutch government) compliance. + +- **Data Centre Location:** Preference for Dutch or at minimum EU-based data centres with transparent information about physical locations. + +### Provider Assessment + +#### Cyso (Netherlands) — Shortlisted + +[Cyso](https://cyso.com/) is a Dutch cloud provider offering OpenStack-based infrastructure with data centres in the Netherlands. + +- **Strengths:** Dutch entity, OpenStack API (maximises portability), Kubernetes support, strong focus on managed hosting and compliance, ISO 27001 certified. +- **Considerations:** Smaller scale compared to hyperscalers; evaluate depth of managed services catalogue (databases, backups, monitoring) and support SLA. +- **Verdict:** Strong fit for sovereignty requirements. The OpenStack API is a significant advantage for avoiding lock-in. Recommended for further evaluation. + +#### Scaleway (France) — Under Evaluation + +[Scaleway](https://www.scaleway.com/) is a French cloud provider (part of the Iliad Group) offering a broad and modern cloud platform. + +- **Strengths:** Comprehensive service catalogue (managed Kubernetes / Kapsule, managed databases, object storage, serverless, container registry), competitive pricing, strong developer experience, modern API and CLI tooling, French/EU data centres. +- **Considerations:** Does not use OpenStack — uses a proprietary (but well-documented) API, which increases provider-specific coupling. However, a Terraform provider is available, mitigating some lock-in risk. French entity, so not Dutch — but firmly within EU jurisdiction. +- **Verdict:** Excellent technical offering with a broad service catalogue. The lack of OpenStack is a trade-off against the richness of features. Good option if the team accepts a degree of API-level coupling. + +#### OVHcloud (France) — Alternative + +[OVHcloud](https://www.ovhcloud.com/) is one of Europe's largest cloud providers and a founding member of GAIA-X. + +- **Strengths:** OpenStack-based public cloud, managed Kubernetes, extensive global data centre network (with multiple EU locations including the Netherlands), competitive pricing, ISO 27001 and HDS certified, GAIA-X member. Terraform provider available. +- **Considerations:** Mixed reputation for support quality. Some enterprise-grade managed services (e.g. advanced database options) lag behind hyperscalers. Recent data centre incidents (Strasbourg, 2021) raised questions about resilience practices — OVHcloud has since invested heavily in improvements. +- **Verdict:** Solid choice for OpenStack-based sovereign cloud. The scale of OVHcloud and GAIA-X membership are meaningful advantages. + +#### STACKIT (Germany) — Alternative + +[STACKIT](https://www.stackit.de/) is the cloud platform of the Schwarz Group (Lidl/Kaufmann), built on OpenStack. + +- **Strengths:** German entity backed by one of Europe's largest retail groups, OpenStack-based, managed Kubernetes (SKE), managed databases (PostgreSQL, MariaDB, Redis, RabbitMQ), object storage, strong compliance posture (ISO 27001, C5), GAIA-X aligned. Terraform provider available. Notably, STACKIT has been contracted by De Nederlandsche Bank (DNB), underscoring its credibility and suitability for highly regulated financial institutions within the EU. +- **Considerations:** Relatively newer entrant to the public cloud market. The service catalogue is growing but may not yet match the breadth of Scaleway or OVHcloud. Less mature community and ecosystem. +- **Verdict:** Strong and increasingly credible choice backed by significant investment and validated by adoption in the European financial sector. OpenStack base and German sovereignty credentials make it a serious contender. + +### Other Notable Providers + +- **[Cleura](https://cleura.com/)** (Sweden): OpenStack-based, formerly City Network. Strong sovereignty focus, compliant cloud, EU data centres. +- **[Open Telekom Cloud](https://open-telekom-cloud.com/)** (Germany): OpenStack-based, operated by T-Systems (Deutsche Telekom). Enterprise-grade with broad service catalogue. +- **[PCextreme](https://www.pcextreme.nl/)** (Netherlands): Dutch OpenStack provider (Aurora Cloud). Smaller scale but strong Dutch sovereignty credentials. + +### Recommendation + +We recommend a structured proof-of-concept comparing **Cyso** and **one other provider** (Scaleway for breadth of services, or OVHcloud/STACKIT for OpenStack portability). Key evaluation dimensions should include: + +1. **Kubernetes maturity:** Deploy a representative workload and assess operational experience. +2. **Terraform/OpenTofu coverage:** Validate that all required resources can be provisioned as code. +3. **Managed services depth:** Evaluate database, backup, monitoring, and networking offerings against project requirements. +4. **Support & SLA:** Test responsiveness and quality of technical support. +5. **Exit strategy:** Confirm that workloads can be migrated to an alternative OpenStack provider or back to a hyperscaler if needed. + +The sovereign cloud landscape in Europe is maturing rapidly. Placing this topic on **assess** reflects that these providers warrant serious evaluation for projects where digital sovereignty is a requirement, while acknowledging that a definitive recommendation requires hands-on validation. + +--- From ec5bb82c9164a5c0dc599baa471a691a252bb1b1 Mon Sep 17 00:00:00 2001 From: Cyril Roos Date: Thu, 23 Apr 2026 16:12:17 +0200 Subject: [PATCH 2/6] reworded some things --- radar/2026-04-23/european-sovereign-cloud.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/radar/2026-04-23/european-sovereign-cloud.md b/radar/2026-04-23/european-sovereign-cloud.md index da02ea1..bd668f8 100644 --- a/radar/2026-04-23/european-sovereign-cloud.md +++ b/radar/2026-04-23/european-sovereign-cloud.md @@ -23,11 +23,11 @@ European Sovereign Cloud refers to cloud infrastructure operated by European pro When evaluating a European sovereign cloud provider, the following criteria are essential: -- **EU Ownership & Jurisdiction:** The provider must be an EU-registered entity with no controlling interest by non-EU parties. This is the foundation of true sovereignty. +- **EU Ownership & Jurisdiction:** The provider must be an EU-registered entity with no controlling interest by non-EU parties. - **OpenStack or Open API:** An open, standardised API — preferably [OpenStack](https://www.openstack.org/) — significantly reduces vendor lock-in. OpenStack is the de facto open standard for cloud infrastructure and enables portability across providers. -- **Managed Kubernetes:** A mature, managed Kubernetes offering (or equivalent container orchestration) is critical for modern application deployment and operations. +- **Managed Kubernetes:** A mature, managed Kubernetes offering is critical for modern application deployment and operations. - **Comprehensive Service Catalogue:** Beyond compute and storage, look for managed databases, object storage, load balancers, DNS, backup services, VPN/networking, and monitoring. @@ -87,6 +87,6 @@ We recommend a structured proof-of-concept comparing **Cyso** and **one other pr 4. **Support & SLA:** Test responsiveness and quality of technical support. 5. **Exit strategy:** Confirm that workloads can be migrated to an alternative OpenStack provider or back to a hyperscaler if needed. -The sovereign cloud landscape in Europe is maturing rapidly. Placing this topic on **assess** reflects that these providers warrant serious evaluation for projects where digital sovereignty is a requirement, while acknowledging that a definitive recommendation requires hands-on validation. +The sovereign cloud landscape in Europe is maturing rapidly. Placing this topic on **trial** reflects that these providers warrant serious evaluation for projects where digital sovereignty is a requirement, while at the same time acknowledging that a definitive recommendation requires hands-on validation. --- From e31b0050c9c8189f74058bb57e849043de28e91d Mon Sep 17 00:00:00 2001 From: Cyril Roos Date: Thu, 23 Apr 2026 16:21:29 +0200 Subject: [PATCH 3/6] reworded some more --- radar/2026-04-23/european-sovereign-cloud.md | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/radar/2026-04-23/european-sovereign-cloud.md b/radar/2026-04-23/european-sovereign-cloud.md index bd668f8..e5ed703 100644 --- a/radar/2026-04-23/european-sovereign-cloud.md +++ b/radar/2026-04-23/european-sovereign-cloud.md @@ -5,11 +5,11 @@ quadrant: platforms-and-operations featured: true --- -European Sovereign Cloud refers to cloud infrastructure operated by European providers, subject exclusively to EU jurisdiction, and designed to guarantee full digital sovereignty. As geopolitical tensions and extraterritorial legislation (such as the US CLOUD Act and FISA Section 702) create uncertainty around data processed by non-EU cloud providers, the need for genuinely sovereign alternatives has become a strategic priority — particularly for organisations handling sensitive data or operating in regulated sectors. +European Sovereign Cloud refers to cloud infrastructure operated by European providers, subject exclusively to EU jurisdiction, and designed to guarantee full digital sovereignty. As geopolitical tensions and extraterritorial legislation (such as the US CLOUD Act and FISA Section 702) create uncertainty around data processed by non-EU cloud providers, the need for genuinely sovereign alternatives has become a strategic priority, particularly for organisations handling sensitive data or operating in regulated sectors. ### Why European Sovereign Cloud? -- **Digital Sovereignty:** Ensures that data, infrastructure, and operations remain entirely within EU legal jurisdiction, eliminating exposure to non-EU government access requests. +- **Digital Sovereignty:** Ensures that data, infrastructure, and operations remain entirely within EU legal jurisdiction, eliminating exposure to non-EU government access requests or restrictions. - **GDPR & Schrems II Compliance:** Following the Schrems II ruling, transferring personal data to US-based providers carries inherent legal risk. European sovereign cloud providers eliminate this concern by design. @@ -25,7 +25,7 @@ When evaluating a European sovereign cloud provider, the following criteria are - **EU Ownership & Jurisdiction:** The provider must be an EU-registered entity with no controlling interest by non-EU parties. -- **OpenStack or Open API:** An open, standardised API — preferably [OpenStack](https://www.openstack.org/) — significantly reduces vendor lock-in. OpenStack is the de facto open standard for cloud infrastructure and enables portability across providers. +- **OpenStack or Open API:** An open, standardised API, preferably [OpenStack](https://www.openstack.org/), significantly reduces vendor lock-in. OpenStack is the de facto open standard for cloud infrastructure and enables portability across providers. - **Managed Kubernetes:** A mature, managed Kubernetes offering is critical for modern application deployment and operations. @@ -33,13 +33,13 @@ When evaluating a European sovereign cloud provider, the following criteria are - **Infrastructure as Code Compatibility:** First-class support for [Terraform](/tools/terraform) / [OpenTofu](https://opentofu.org/) providers is essential for automation and reproducibility. -- **Certifications:** ISO 27001, SOC 2, and — depending on context — NEN 7510 (healthcare) or BIO (Dutch government) compliance. +- **Certifications:** ISO 27001, SOC 2, and, depending on context, NEN 7510 (healthcare) or BIO (Dutch government) compliance. - **Data Centre Location:** Preference for Dutch or at minimum EU-based data centres with transparent information about physical locations. ### Provider Assessment -#### Cyso (Netherlands) — Shortlisted +#### Cyso (Netherlands), Shortlisted [Cyso](https://cyso.com/) is a Dutch cloud provider offering OpenStack-based infrastructure with data centres in the Netherlands. @@ -47,23 +47,23 @@ When evaluating a European sovereign cloud provider, the following criteria are - **Considerations:** Smaller scale compared to hyperscalers; evaluate depth of managed services catalogue (databases, backups, monitoring) and support SLA. - **Verdict:** Strong fit for sovereignty requirements. The OpenStack API is a significant advantage for avoiding lock-in. Recommended for further evaluation. -#### Scaleway (France) — Under Evaluation +#### Scaleway (France), Under Evaluation [Scaleway](https://www.scaleway.com/) is a French cloud provider (part of the Iliad Group) offering a broad and modern cloud platform. - **Strengths:** Comprehensive service catalogue (managed Kubernetes / Kapsule, managed databases, object storage, serverless, container registry), competitive pricing, strong developer experience, modern API and CLI tooling, French/EU data centres. -- **Considerations:** Does not use OpenStack — uses a proprietary (but well-documented) API, which increases provider-specific coupling. However, a Terraform provider is available, mitigating some lock-in risk. French entity, so not Dutch — but firmly within EU jurisdiction. +- **Considerations:** Does not use OpenStack, instead using a proprietary (but well-documented) API, which increases provider-specific coupling. However, a Terraform provider is available, mitigating some lock-in risk. French entity, so not Dutch, but firmly within EU jurisdiction. - **Verdict:** Excellent technical offering with a broad service catalogue. The lack of OpenStack is a trade-off against the richness of features. Good option if the team accepts a degree of API-level coupling. -#### OVHcloud (France) — Alternative +#### OVHcloud (France), Alternative [OVHcloud](https://www.ovhcloud.com/) is one of Europe's largest cloud providers and a founding member of GAIA-X. - **Strengths:** OpenStack-based public cloud, managed Kubernetes, extensive global data centre network (with multiple EU locations including the Netherlands), competitive pricing, ISO 27001 and HDS certified, GAIA-X member. Terraform provider available. -- **Considerations:** Mixed reputation for support quality. Some enterprise-grade managed services (e.g. advanced database options) lag behind hyperscalers. Recent data centre incidents (Strasbourg, 2021) raised questions about resilience practices — OVHcloud has since invested heavily in improvements. +- **Considerations:** Mixed reputation for support quality. Some enterprise-grade managed services (e.g. advanced database options) lag behind hyperscalers. Recent data centre incidents (Strasbourg, 2021) raised questions about resilience practices, though OVHcloud has since invested heavily in improvements. - **Verdict:** Solid choice for OpenStack-based sovereign cloud. The scale of OVHcloud and GAIA-X membership are meaningful advantages. -#### STACKIT (Germany) — Alternative +#### STACKIT (Germany), Alternative [STACKIT](https://www.stackit.de/) is the cloud platform of the Schwarz Group (Lidl/Kaufmann), built on OpenStack. From 69e4e09491dd8c92813f3894976f60a8084ed12f Mon Sep 17 00:00:00 2001 From: Cyril Roos Date: Thu, 23 Apr 2026 16:28:21 +0200 Subject: [PATCH 4/6] added remark --- radar/2026-04-23/european-sovereign-cloud.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/radar/2026-04-23/european-sovereign-cloud.md b/radar/2026-04-23/european-sovereign-cloud.md index e5ed703..e3831f8 100644 --- a/radar/2026-04-23/european-sovereign-cloud.md +++ b/radar/2026-04-23/european-sovereign-cloud.md @@ -51,7 +51,7 @@ When evaluating a European sovereign cloud provider, the following criteria are [Scaleway](https://www.scaleway.com/) is a French cloud provider (part of the Iliad Group) offering a broad and modern cloud platform. -- **Strengths:** Comprehensive service catalogue (managed Kubernetes / Kapsule, managed databases, object storage, serverless, container registry), competitive pricing, strong developer experience, modern API and CLI tooling, French/EU data centres. +- **Strengths:** Comprehensive service catalogue (managed Kubernetes / Kapsule, managed databases, object storage, serverless, container registry), competitive pricing, strong developer experience, modern API and CLI tooling, out-of-the-box ovservability, French/EU data centres. - **Considerations:** Does not use OpenStack, instead using a proprietary (but well-documented) API, which increases provider-specific coupling. However, a Terraform provider is available, mitigating some lock-in risk. French entity, so not Dutch, but firmly within EU jurisdiction. - **Verdict:** Excellent technical offering with a broad service catalogue. The lack of OpenStack is a trade-off against the richness of features. Good option if the team accepts a degree of API-level coupling. From 19b98bb376c59cd351c75685b8205611955baa61 Mon Sep 17 00:00:00 2001 From: Cyril Roos Date: Thu, 23 Apr 2026 16:37:31 +0200 Subject: [PATCH 5/6] reworded cyso and removed aurora cloud --- radar/2026-04-23/european-sovereign-cloud.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/radar/2026-04-23/european-sovereign-cloud.md b/radar/2026-04-23/european-sovereign-cloud.md index e3831f8..b968a50 100644 --- a/radar/2026-04-23/european-sovereign-cloud.md +++ b/radar/2026-04-23/european-sovereign-cloud.md @@ -43,7 +43,7 @@ When evaluating a European sovereign cloud provider, the following criteria are [Cyso](https://cyso.com/) is a Dutch cloud provider offering OpenStack-based infrastructure with data centres in the Netherlands. -- **Strengths:** Dutch entity, OpenStack API (maximises portability), Kubernetes support, strong focus on managed hosting and compliance, ISO 27001 certified. +- **Strengths:** Dutch entity, OpenStack API (maximises portability), Kubernetes support, strong focus on managed hosting and compliance, ISO 27001 and NEN 7510 certified. Through the acquisition of [Fuga Cloud](https://www.fuga.cloud/), Cyso now operates a mature OpenStack-based public cloud platform with multiple EU regions (Amsterdam, Frankfurt, and more planned), NVMe storage, and a "4 opens" philosophy (open development, open standards, open source, open collaboration). - **Considerations:** Smaller scale compared to hyperscalers; evaluate depth of managed services catalogue (databases, backups, monitoring) and support SLA. - **Verdict:** Strong fit for sovereignty requirements. The OpenStack API is a significant advantage for avoiding lock-in. Recommended for further evaluation. @@ -75,7 +75,6 @@ When evaluating a European sovereign cloud provider, the following criteria are - **[Cleura](https://cleura.com/)** (Sweden): OpenStack-based, formerly City Network. Strong sovereignty focus, compliant cloud, EU data centres. - **[Open Telekom Cloud](https://open-telekom-cloud.com/)** (Germany): OpenStack-based, operated by T-Systems (Deutsche Telekom). Enterprise-grade with broad service catalogue. -- **[PCextreme](https://www.pcextreme.nl/)** (Netherlands): Dutch OpenStack provider (Aurora Cloud). Smaller scale but strong Dutch sovereignty credentials. ### Recommendation From 8136c50f56fcc0200b7d7ddb7dd1e4894f1031bf Mon Sep 17 00:00:00 2001 From: Cyril Roos Date: Fri, 24 Apr 2026 13:07:06 +0200 Subject: [PATCH 6/6] add costs as a selection criterium --- radar/2026-04-23/european-sovereign-cloud.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/radar/2026-04-23/european-sovereign-cloud.md b/radar/2026-04-23/european-sovereign-cloud.md index b968a50..90e0c82 100644 --- a/radar/2026-04-23/european-sovereign-cloud.md +++ b/radar/2026-04-23/european-sovereign-cloud.md @@ -33,6 +33,8 @@ When evaluating a European sovereign cloud provider, the following criteria are - **Infrastructure as Code Compatibility:** First-class support for [Terraform](/tools/terraform) / [OpenTofu](https://opentofu.org/) providers is essential for automation and reproducibility. +- **Cost Transparency & Competitiveness:** Transparent, predictable pricing without hidden fees. Evaluate compute, storage, egress, and managed services costs against each other and hyperscaler equivalents. Pricing models vary significantly between providers and should be compared per use case. + - **Certifications:** ISO 27001, SOC 2, and, depending on context, NEN 7510 (healthcare) or BIO (Dutch government) compliance. - **Data Centre Location:** Preference for Dutch or at minimum EU-based data centres with transparent information about physical locations.