Companies are placing increasing importance on their data and want to know where and by whom it is managed. Sovereign Cloud has been available as an on-premises solution (for several years).  

A concept that has only just seen the light of day for most people, but has actually been around for years. Among the well-known cloud types is the lesser-known Sovereign Cloud, where data is stored and managed locally. Awareness of data and security is being raised in Europe and in the media, which means that more and more eyes are turning to a sovereign solution.

What is a Sovereign Cloud?

We all know about private and public cloud or a combination of them under the name hybrid cloud, but not much is known about the sovereign cloud. This type of cloud is a new concept for most companies, but has been increasingly seeing the light of day recently.

Sovereign Cloud means that your data is stored and managed locally, for example within the borders of Belgium. This way, companies have more control over their data and know exactly where it is located in the Belgian data centers. This means that your data is protected from foreign governments, for example.

This is in contrast to a public cloud, where your data can be located anywhere and you have less control over who manages it. For companies that want to keep their data as close as possible, the Sovereign Cloud is the solution.

The sovereign cloud is crucial for certain organizations to comply with national and European data protection regulations. Companies are processing increasingly sensitive data and stricter laws are needed to protect this information. Compliance with this legislation is crucial for the survival and continuity of organizations. In some cases, digital sovereignty and full control over the data are necessary.

European legislation

The EU maintains strict data protection rules, in particular the General Data Protection Regulation (GDPR) and the ePrivacy Directive. Under the GDPR, organizations are legally obliged to store and process data from users based in the EU within the EU or in jurisdictions that ensure a comparable level of data protection.

In practice, most data in the cloud is stored in the data centers of American hyperscalers. The EU’s goal is to reduce this dependency and limit the risk of foreign access to European companies’ data. Data is crucial for innovations such as artificial intelligence, in which the EU is a leader. New European regulations therefore oblige companies, organizations and governments to store all sensitive, critical and confidential data exclusively within the EU in the future. Companies must adapt their cloud strategy accordingly.

(N)equivocal definition

Although the definition of Sovereign Cloud seems self-explanatory, it can be interpreted in different ways. The meaning of Sovereign Cloud depends on how you define the local region.

A sovereign cloud refers to a cloud computing service that operates in compliance with the laws of a specific country. Because these laws vary by country and jurisdiction, there is no universally accepted definition of a sovereign cloud. In general, a sovereign cloud provides access to data that complies with local data protection laws and protects against third-party access to that data (including metadata).

For a Belgian company, Sovereign Cloud means that its data is located in its own country and managed by Belgians. If you have several data centers in Europe, sovereignty will cover a larger area and remain within European borders. This data is protected from China or America, for example, but not within Europe. There is no single definition of a sovereign cloud. It depends on how you interpret “local”.

For us, the Sovereign Cloud is purely Belgian: data is stored locally in Belgium and managed only by Belgians.

Chris Carremans, Business Unit Manager and Partner at Easi

An example of a Belgian cloud provider is Easi. They offer a purely Belgian sovereign cloud, where data is not transferred across national borders. They go a step further and say that the tools for the cloud must also be sovereign and hosted in Belgium. “There are many tools that are managed in a public cloud and that American governments, for example, have access to,” says Carremans. So the sovereign aspect goes beyond just the cloud.

Dates in a private cage

The security, integrity and availability of data begins with its physical protection. This includes highly reliable data center facilities, a hardware layer, immutable backups, Disaster recoveryprotocols, securely encrypted networks and robust, redundant data center connections.

In addition to a very strict access policy to the physical environment, a zero-trust principle can be implemented for the workloads running on this cloud platform. So the data in a sovereign cloud is in a protected area and managed locally, but what does this look like in practice?

Cloud provider Easi does not have its own hardware and materials, but uses a provider’s data centers. The most important aspect of the Sovereign Cloud is that you know where your data is and who can access it. To meet the latter requirement, Easi stores its data in private cages so that external providers cannot access their data. They are only reachable in emergencies, but even then someone from Easi is always on site to check. “The advantage of managing everything ourselves means that we can keep complete control of the operation of our cloud,” says Carremans.

Emerging cloud

The concept of Sovereign Cloud has been around for a long time. Cloud providers like Easi have been offering Sovereign Cloud for years, but this concept is not yet available to most companies right at the top of my head. Nevertheless, there is increasing interest in the sovereign cloud as awareness of data and security continues to grow.

More and more companies want to know where their data is and who can access it. It is being accepted more quickly, especially within European borders. “The idea that data is protected from countries like America is already reassuring for most companies,” says Carremans.

Sovereign vs. private cloud

The definition of a sovereign cloud is somewhat similar to that of a private cloud, but not quite the same. A private cloud can be located in multiple locations, for example in Belgium and the Netherlands. This means that governments in other countries can still access your data if they have a court order to do so.

With the Sovereign Cloud, your data does not go beyond the protected borders. In principle, a Sovereign Cloud can be described as a private cloud, but with a sovereign shell. Your data in a Sovereign Cloud can be located in multiple locations, for example in a private cloud, but does not cross borders, for example in Belgium.

For whom?

Some companies want to keep their data as close to home as possible. Whether this is European or Belgian depends largely on what the party accepts as sovereign. Easi, for example, sees no noticeable difference between, for example, government agencies or private companies in using the Sovereign Cloud.

If you are convinced that this is necessary for your business, then Sovereign Cloud is a good idea.

Chris Carremans, Business Unit Manager and Partner at Easi

Nevertheless, it may be more interesting for one institution than another. Sovereign clouds comply with local regulations and offer security to companies operating in highly regulated industries such as healthcare and finance. In addition, with a local cloud you stimulate economic development. Investments in infrastructure, jobs and skills in Belgian or European companies can lead to economic growth and stability.

Companies that consciously choose to keep their data as close as possible will start using the Sovereign Cloud today, but there are also many companies that are not yet aware of this. A general trend is not yet apparent, but the Sovereign Cloud will play an important role in the future, perhaps even more important than ever.