European Sovereign Cloud Providers Compared: Ownership, Jurisdiction and Admin Access

Ownership decides which governments can demand data from a sovereign cloud provider. The US CLOUD Act lets US authorities demand data held abroad by a provider under US jurisdiction.

We sort the sovereign cloud providers selling in Europe into three groups by who owns the operating company. Then we list two questions each provider should answer in writing before signing a contract.

How Do European Sovereign Cloud Providers Split by Owner?

European sovereign cloud providers split into three groups by who owns the company running the cloud:

1. US cloud providers with EU-isolated regions: A US parent company runs the cloud through EU subsidiaries and EU staff.
2. European operators running US cloud software: A European company runs the cloud, and a US provider supplies the software.
3. European-owned providers: A European parent company runs the cloud on its own technology.

EU institutions can now buy from the second and third groups. The European Commission awarded a six-year sovereign cloud framework contract worth up to €180 million in April 2026.

The winners include STACKIT, Scaleway, a consortium with OVHcloud and Clever Cloud, and a consortium with S3NS. To win, each provider had to show that companies outside the EU have little control over its technology and services.

US Cloud Providers With EU-Isolated Regions

Have your lawyers check whether the EU companies and the technical separation would stop a US court order before you buy from this group.

AWS European Sovereign Cloud

AWS runs its European Sovereign Cloud through a German parent company and three German subsidiaries, led by EU citizens.

AWS opened the first region in Brandenburg, Germany. Staff who live in the EU handle day-to-day operations.

AWS says its Nitro System, the hardware and software layer under Amazon EC2, keeps AWS employees from reaching customer workloads and data. NCC Group, an independent security firm, checked that claim.

AWS also offers more than 245 sovereignty rules customers can switch on in AWS Control Tower, its account-management service. Dedicated Local Zones, AWS infrastructure built for one customer's use, let a buyer require security clearance for local AWS staff.

AWS suits a buyer who accepts a US parent and wants EU companies, EU-based staff and staff vetting written into the contract.

Microsoft Azure: Data Residency and Customer-Held Keys

Azure handles data residency through its EU Data Boundary, which keeps customer data stored and processed in the EU. Customers can hold their own encryption keys in Azure Key Vault or Managed HSM, a hardware security module.

Confidential computing uses protected areas of the chip to keep data encrypted during processing. These controls limit what Microsoft staff can see.

A US court can still order Microsoft to hand over data it controls, so ask your lawyers how much the customer-held keys reduce that risk.

Azure works for buyers whose rules call for data residency in the EU and who want to hold their own keys. Microsoft's partner-run clouds in France and Germany appear in the next section.

Oracle EU Sovereign Cloud

Oracle keeps its EU Sovereign Cloud physically, logically and cryptographically separate from the rest of its cloud. The Frankfurt and Madrid regions back each other up for disaster recovery and offer more than 200 services, with NVIDIA H200 servers among the hardware.

Oracle runs the service through legal entities incorporated in Germany, Spain, Poland, Romania, the Czech Republic and Ireland, with boards of European nationals. Oracle suits GPU work where the buyer wants EU companies running the service on a large US provider's platform.

Google Distributed Cloud

Google says it can't remotely shut down the air-gapped mode of Google Distributed Cloud. Use it when your rules bar the provider from remote shutdown.

European Operators Running US Cloud Software

Updates, patches and support still come from the US company. A cut-off would leave the European operator unable to update the service.

S3NS (Google Cloud Technology)

S3NS runs Google Cloud Dedicated in France under the name PREMI3NS. S3NS is a French-law company controlled by Thales.

Google supplies the software, and S3NS operates the infrastructure and data centers. Google also lists Google Cloud Dedicated in Germany, in preview.

PREMI3NS received SecNumCloud qualification from ANSSI, the French cybersecurity agency, on December 17, 2025. SecNumCloud sets ANSSI's requirements for trusted cloud services, including protection against non-European laws.

Bleu and Delos Cloud (Microsoft Technology)

Bleu, a joint venture of Orange and Capgemini, runs Microsoft cloud services in France, and Delos Cloud, an SAP subsidiary, does the same in Germany.

Microsoft signed an agreement with Delos Cloud in November 2025. It gives Delos Cloud the legal right to use Microsoft's cloud software code if a government outside Europe restricts Microsoft's service to specific customers.

Delos Cloud customers could keep their Microsoft services running in that situation. Ask Bleu in writing whether it has the same right, and whether it has received SecNumCloud qualification.

European-Owned Sovereign Cloud Providers

These providers have European owners, so US ownership doesn't bring them under the CLOUD Act. Check whether each one has US subsidiaries or US operations, which can bring part of the business under US law.

STACKIT: German-Owned Cloud

STACKIT belongs to the Schwarz Group, the owner of Lidl and Kaufland, through Schwarz Digits Cloud GmbH & Co. KG in Germany. STACKIT said in July 2026 that it falls outside the US CLOUD Act.

STACKIT runs seven data centers in Germany and Austria and offers more than 40 cloud services.

STACKIT holds C5 Type 2, a cloud security certificate from Germany's federal security agency based on an outside audit, and ISO 27001, the international standard for security management. BDO, an audit firm, has checked more than 100 of STACKIT's ES³ criteria.

Pick STACKIT when your rules exclude non-European owners and call for C5 Type 2.

Scaleway: French-Owned Cloud for AI Inference

Scaleway belongs to the iliad Group in France. It lists more than 100 cloud, AI and quantum products and runs in France, Poland, Italy and the Netherlands, with Sweden and Germany planned.

Scaleway says it became the first European sovereign inference provider on Hugging Face in 2025. That claim matters to teams serving open models from Hugging Face who need a French parent company.

Clever Cloud

Clever Cloud says French law governs the company, which keeps it outside the reach of non-European laws. Its sovereign cloud page argues that a cloud run in Europe can still fall under foreign laws if it depends on a non-European company.

Clever Cloud runs eight data centers in the EU, seven of them in France, and holds ISO 27001 and HDS, France's certification for hosting health data.

Clever Cloud introduced the Ultimate Sovereignty Clause in June 2026. The clause is a contract term that protects customers if a non-European company takes control of Clever Cloud.

Customers who need SecNumCloud can get it through Cloud Temple's qualified infrastructure. Clever Cloud is working toward qualification of its own platform.

Choose Clever Cloud when French law must govern the provider, including for health data under HDS.

OVHcloud: French-Owned Cloud With US Data Centers

OVHcloud, legally OVH Groupe SA, is a French company listed on Euronext Paris, with data centers in Europe, North America and Asia-Pacific.

Ask which OVHcloud company would run your service, since it also operates data centers in the US. OVHcloud and Clever Cloud won their share of the Commission's contract in the same consortium.

Does a Sovereign Cloud Cost More?

BCG estimates that sovereign offers from large US cloud providers cost 10% to 30% more than public cloud at list price.

BCG adds that incentives such as subsidized bandwidth and free credits can bring the real premium well below the list range. The S3NS figure comes from an interview with Le Monde Informatique.

Ask each provider to price your workload in writing, since Oracle's statement and BCG's estimate differ for the same offer.

What Should Each Sovereign Cloud Provider Answer in Writing?

Each provider should answer two questions in writing: who can technically reach your data, and how your data and workloads leave when the contract ends.

Nutanix builds its sovereignty checks on the European Commission's Cloud Sovereignty Framework, the scoring method behind the €180 million award. Its exit test asks whether data and workloads can move to another provider.

1. Admin access: Name the roles that can reach customer data, the country whose labor law covers the staff in each role, and the independent audit that checked those access limits. "Encryption keys stay in a hardware security module the customer owns" passes, and "data is protected under European law" scores zero.
2. Exit: Name the documented export process, the file formats, the time frame and the fees for moving data and workloads out. "Data exports in open formats through a documented API within 30 days, with egress fees waived" passes, and "we support migration on request" scores zero.

Back the written answers with a technical audit of the hardware, software, data, encryption keys and operators.

Which Sovereign Cloud Provider Fits Which Requirement?

Match the requirement to a group first, then compare the providers in that group.

1. A rule against non-European owners: Choose from STACKIT, Scaleway, Clever Cloud or OVHcloud, and check each for US subsidiaries or US operations.
2. SecNumCloud in France: S3NS holds the qualification for PREMI3NS, and Clever Cloud offers it through Cloud Temple's infrastructure.
3. An air gap: Google Distributed Cloud's air-gapped mode works when your rules bar the provider from remote shutdown.
4. A US parent with EU subsidiaries is acceptable: Compare AWS, Oracle and Azure on their written answers about who can reach your data.
5. Cost: Get written pricing from each provider for the same workload.

AI workloads need wider sovereignty checks. The access and exit questions also have to cover model weights, training data and inference logs.

Zettabyte builds, operates and finances sovereign and large-scale GPU environments for AI. We haven't scored our own offers here, since this comparison covers general-purpose sovereign clouds.