Demand for sovereign cloud is rising fast across Europe in 2026. Gartner expects spending on sovereign cloud IaaS in the region to reach around $12.6 billion this year, an increase of 83% from 2025. That jump shows how quickly sovereignty is moving into normal cloud planning. More organisations are now reviewing who controls their infrastructure before they place sensitive systems or regulated workloads with an outside provider.
There are several reasons behind that change. Companies are moving more important systems into the cloud, which increases the amount of trust placed in outside providers. They want a clearer view of who can access their data, where support teams are based, and which laws may apply. Dependence on technology controlled outside Europe has also become a bigger concern for both private companies and public organisations.
This has changed the way companies look at cloud location. A server in Frankfurt or Paris may keep data inside the EU, which can help with residency requirements. Other questions remain open. The cloud operator may have a foreign parent, support teams may work from another jurisdiction, and key technologies may be controlled elsewhere. For sensitive workloads, those details can matter just as much as the country on the map.
The 10 providers below approach those issues in very different ways. This comparison looks at how much control each model can give the customer.
Data sovereignty is the level of control an organisation keeps over its data once another company stores or processes it. The country where the information remains is important, but the provider’s legal structure matters too. The way the cloud is operated can also influence how much control stays with the customer.
Administrative access is another important part of sovereignty. A cloud provider may store data in Europe while support staff or system administrators work from another jurisdiction. Encryption is worth considering as well, especially when an organisation wants to keep its own keys and limit who can decrypt sensitive information inside the cloud environment.
This is why sovereignty goes further than a location setting. A European cloud region can provide strong residency and still leave other dependencies unchanged. The customer may still rely on a foreign parent company, external administrators or technology controlled elsewhere, which can matter when the workload carries sensitive or regulated information.
Cloud sovereignty has become more relevant in Europe as organisations place more sensitive work in infrastructure they do not fully operate themselves. Once important systems depend on a cloud provider, the relationship becomes about more than storage. Access to the environment, legal exposure and the ability to keep services running can all become part of the risk.
That concern has grown alongside European regulation, which increasingly expects organisations to understand the technology providers they depend on. Keeping data inside Europe can help, but it doesn’t settle every issue. A company may still rely on outside administrators or technology controlled elsewhere, which can matter when something goes wrong.
The pressure is naturally stronger where the consequences are higher. Banks cannot treat a major outage as a minor IT problem. Hospitals have similar concerns around sensitive information and continuity. Government systems may require even tighter boundaries. In those cases, sovereign cloud can give organisations more control over the conditions surrounding critical workloads.
The word “sovereign” can cover very different cloud setups, so the label itself does not say much. A better way to judge a provider is to look at where control sits throughout the service. That starts with the data, then extends to access and the infrastructure that keeps the workload running.
These checks help reveal where the real dependencies sit. They also show why GDPR compliance alone cannot describe the sovereignty of a cloud service. The customer still needs to understand how the environment is operated.
| Provider | Main European presence | Sovereignty model | Key strength | Best for |
|---|---|---|---|---|
| Ilkari | Croatia, Ireland and Iceland | Directly operated shared and dedicated cloud | Strong infrastructure and operational control | Sensitive workloads |
| OVHcloud | France and wider EU | European cloud with qualified sovereign environments | Mature sovereign portfolio | Regulated organisations |
| Scaleway | France, Netherlands, Poland and Italy | European-owned public cloud | SEAL-3 assessed offering | Cloud-native and AI workloads |
| IONOS | Germany and wider EU | German public and private cloud | BSI-aligned assurance | German and EU enterprises |
| Aruba Cloud | Italy, Czech Republic and wider EU | European cloud with owned core infrastructure | Physical infrastructure control | Hybrid and regional workloads |
| Cloud Temple | France | SecNumCloud-qualified sovereign cloud | Formal ANSSI qualification | French public sector and sensitive workloads |
| Oracle EU Sovereign Cloud | Germany and Spain | Separate EU sovereign cloud realm | Broad OCI capabilities in an isolated environment | Oracle-heavy enterprises |
| AWS European Sovereign Cloud | Germany, with additional sovereign locations planned | Separate European AWS sovereign environment | AWS ecosystem with stronger EU controls | AWS-centric regulated organisations |
| Microsoft Sovereign Cloud | Across Europe | Public, private and partner-operated sovereign models | Flexible deployment options | Microsoft-centric organisations |
| STACKIT | Germany and Austria | European sovereign public cloud | SEAL-3 assessed offering | DACH and EU organisations |
Best for: Sensitive workloads that benefit from dedicated infrastructure and a clearly defined operating model.
Ilkari is an Irish-headquartered provider with EU infrastructure in Varaždin, Croatia. Its DC North facility forms part of the company’s wider sovereign infrastructure platform. Customers can choose between shared cloud and a dedicated model built for one organisation. The dedicated option gives buyers a clearer separation boundary without adding another hyperscaler underneath the service.
Ilkari operates the infrastructure behind the cloud itself, which gives customers a more direct relationship with the company responsible for the environment. It also reduces the number of operational layers involved. The limitation is breadth. Ilkari has a smaller service ecosystem than established hyperscalers, and buyers should verify the exact scope of certifications for the workload they plan to run.
Best for: Large organisations that want European control without giving up cloud variety.
OVHcloud has a long presence in Europe and is headquartered in France. Its sovereign portfolio includes services qualified under SecNumCloud, as well as Trusted Zone environments built for customers with stricter requirements. These options can be useful for regulated workloads where ordinary European hosting does not provide enough clarity around operations or access.
OVHcloud also gives customers a broad range of infrastructure choices. Public cloud and bare metal are available, along with private cloud services. That can make migration easier for organisations with different technical needs. The main limitation is consistency across the portfolio. Qualification applies only to specific services, and some products still use proprietary technology supplied by third parties.
Best for: Teams that want modern cloud services under European ownership.
Scaleway is a French cloud provider with infrastructure across several European markets. It offers the services expected from a modern public cloud, including compute and storage. Managed databases and Kubernetes are also available, while its growing AI portfolio makes the platform relevant for companies building newer applications that still want to keep their cloud strategy focused on European providers.
The European Commission selected Scaleway for its 2026 sovereign-cloud procurement, and the relevant offering achieved SEAL-3. That assessment looks beyond data location and also considers technological autonomy. Scaleway is still going through the SecNumCloud qualification process, however. Buyers should keep the two frameworks separate and confirm the latest qualification status if SecNumCloud is a formal requirement for the workload.
Best for: Companies that want German jurisdiction without limiting themselves to a narrow specialist cloud.
Based in Montabaur, IONOS combines German corporate control with a general-purpose cloud platform designed for enterprise use. Its assurance profile includes C5 reporting and ISO 27001 based on IT-Grundschutz, both of which are well understood in the German market. This gives organisations a European cloud option with a security model that fits familiar procurement language while still supporting a broad range of technical workloads.
IONOS supports typical enterprise workloads through compute, storage, networking, Kubernetes and managed databases. Private and hybrid environments are available too. The physical data-centre model is not identical everywhere, however. Some facilities are run by external partners, so organisations with strict requirements around infrastructure ownership should review the exact location and contract instead of assuming the same level of control across the whole footprint.
Best for: European organisations that want stronger visibility over the physical infrastructure behind their cloud.
Aruba is headquartered in Italy and combines cloud services with its own data-centre operations. Its core facilities include locations in Italy and the Czech Republic, where the company has direct control over more of the physical environment. The European network also includes partner sites, so the infrastructure model can change depending on the region a customer chooses.
The platform covers public and private cloud, along with bare metal and disaster-recovery services. Aruba also publishes a broad compliance portfolio that includes several ISO standards and CSA STAR Level 2. Its strongest sovereignty case comes from locations where it operates the facility itself. Buyers using partner sites should check which company controls the physical infrastructure behind their workload.
Best for:** Organisations that need a French cloud with formally qualified IaaS and PaaS services.
Cloud Temple is a France-based provider with a strong focus on sensitive cloud environments. Its IaaS and OpenShift PaaS include services qualified under SecNumCloud, giving customers independent assurance from ANSSI for a defined technical scope. This makes the provider especially relevant where national qualification matters more than simply keeping data inside a French or European data centre.
Its platform includes private cloud, storage and key-management options for organisations that need more control around sensitive workloads. Cloud Temple remains more specialised than providers with large European or global footprints, which can limit flexibility for multinational deployments. For workloads centred in France, however, the smaller scale may be less important than having a clear qualification perimeter and a locally focused operating model.
Best for: Enterprises with large Oracle estates that need a more isolated EU cloud environment.
Oracle has built its EU Sovereign Cloud around dedicated regions in Germany and Spain. The service is separated from Oracle’s ordinary commercial cloud and operates through European legal entities. Oracle also states that EU-based personnel manage the environment. This gives organisations a stronger regional boundary while allowing them to keep using Oracle databases, compute and other OCI services already built into their systems.
For existing Oracle customers, that can reduce the disruption of moving sensitive workloads into a more controlled environment. The trade-off comes from the wider technology relationship. Oracle remains a US-headquartered company and continues to control the underlying platform. Organisations that require European corporate ownership or greater technology independence may therefore find a European-owned provider better aligned with their sovereignty requirements.
Best for: Companies that want familiar AWS services inside a more isolated EU operating model.
AWS built its European Sovereign Cloud as an independent environment for customers with stricter sovereignty requirements. The first Region opened in Brandenburg in 2026. It operates separately from standard AWS commercial Regions and uses dedicated European structures. AWS says infrastructure remains within the EU, while day-to-day operations are controlled by personnel based there, creating a stronger regional boundary around sensitive workloads.
The biggest advantage is continuity. Existing AWS customers can keep familiar tools and architecture rather than rebuilding their systems on another cloud. That convenience comes with limits. AWS remains part of US-based Amazon, and the underlying technology stays proprietary. The sovereign environment also has a shorter operating history, so buyers should check service availability and recovery design before relying on it for critical systems.
Best for: Organisations that want stronger sovereignty controls without leaving the Microsoft ecosystem.
Microsoft takes a broad approach to sovereignty in Europe. Its public-cloud model adds extra controls around access and data location, while Azure Local can move more infrastructure under the customer’s direct control. National partner clouds provide another route in some markets. The result is a range of options that can support anything from ordinary enterprise workloads to more sensitive systems.
The advantage is continuity. Companies can keep familiar Microsoft services while increasing control where they need it most. The challenge is that sovereignty varies considerably between deployments. A public Azure region does not offer the same separation as a locally operated private environment. Buyers should therefore look closely at where the workload runs and who can access or manage it.
Best for: Organisations trying to reduce dependence on non-European cloud platforms.
STACKIT is part of Germany’s Schwarz Group and operates infrastructure in Germany and Austria. Its cloud covers core services such as compute, networking and storage, with Kubernetes and several managed databases also available. The regional footprint is smaller than that of the major hyperscalers, but this can suit organisations that prefer a European operating model and do not need infrastructure spread across dozens of countries.
Its place in the European Commission’s 2026 sovereign-cloud procurement gives that position additional weight. The assessed STACKIT offer achieved SEAL-3, which includes requirements around technological autonomy and resilience. The smaller ecosystem remains the main consideration for buyers. Companies with highly global operations may need broader coverage, while organisations focused on Europe may see the tighter regional footprint as an acceptable trade-off.
A sovereign cloud decision brings together legal, operational and technical concerns that ordinary cloud comparisons may not cover in much detail. The balance will depend on the organisation and the workload. A company may accept shared infrastructure but require strict local access, while another may care more about dedicated hardware or control over encryption keys.
What to Check Before Choosing
A good sovereign-cloud choice should give enough control for the workload while keeping the architecture practical to operate.
A regular European cloud region mainly gives customers a location commitment. The provider keeps data in a selected European country or region, which can help with residency requirements and latency. That is useful, but it does not automatically explain who can access the environment or which legal entity controls the service.
A sovereign cloud places more controls around that European location. These can affect administrator access, the provider’s jurisdiction and the way encryption is handled. In some cases, the infrastructure or operating teams are also kept within defined European boundaries. The exact model changes from one provider to another.
The exact controls vary between providers, which is why location alone is not enough to judge sovereignty. Two services can keep data in the same country and still offer very different levels of access control, legal separation and operational independence around that data.
There is no single sovereign cloud that fits every European organisation. The right choice depends on the workload and the level of control it requires. Some companies will care most about jurisdiction. Others will focus on infrastructure ownership, operational access or how dependent the platform remains on technology controlled elsewhere.
That is why providers such as Ilkari, Aruba Cloud and Oracle EU Sovereign Cloud can all make sense for different reasons. Ilkari offers a more direct infrastructure model, Aruba brings strong data-centre ownership in key locations, while Oracle gives existing OCI customers a more isolated European environment. The best fit depends on which of those controls matters most.
Yes. AWS offers a dedicated sovereign cloud in Europe, but its normal European regions are different. AWS European Sovereign Cloud launched in Germany in 2026 and runs in a separate AWS partition with dedicated European operating controls. It gives customers more regional separation while keeping familiar AWS tools and services. Amazon is still a US company, so organisations that require European ownership may decide that a European-owned provider fits their needs better.
Yes, but Azure is not sovereign in the same way in every deployment. Microsoft offers several options, including added controls in public Azure, Azure Local and partner-operated clouds in some European countries. Each model gives customers a different level of control over infrastructure and operations. A normal Azure region in Europe mainly provides regional hosting. Buyers should review who operates the environment and where the workload runs before calling it sovereign.
A private cloud describes who uses the infrastructure. A sovereign cloud describes who controls it and under which rules. Private cloud usually means one organisation has a dedicated environment, but that environment may still depend on a foreign provider or remote administrators. Sovereign cloud looks at wider issues such as jurisdiction, privileged access and control of the service. A private cloud can be sovereign, but dedication alone does not make it one.
No. GDPR allows companies to transfer personal data outside the EU when the required protections are in place. The exact mechanism depends on where the information is going. Some countries benefit from an adequacy decision, while other transfers may use Standard Contractual Clauses. European hosting can reduce the number of international transfer questions an organisation needs to handle, but it is not a general legal requirement for every workload.
Sovereign cloud is especially relevant for government, finance, healthcare, defence and organisations running critical infrastructure. These sectors often face higher risks if sensitive data is exposed or important systems stop working. Their concerns also vary. Banks may focus on continuity, hospitals on personal data and governments on jurisdiction. This does not mean the whole organisation needs sovereign infrastructure. Companies can reserve stronger controls for workloads where security, access or resilience requirements are highest.
