Glossary term
Sovereign cloud
Also: Souveräne Cloud, EU-sovereign cloud
A cloud deployment model that guarantees operational, legal and technical control of data and workloads within a specific jurisdiction (typically the EU). Sovereign cloud answers the concern that hyperscaler deployments remain exposed to foreign jurisdiction, primarily the US CLOUD Act.
Sovereign cloud is not one product. It ranges from hyperscaler sovereign regions (limited operational sovereignty) through sovereign overlays (dedicated operations staff and key control) to fully EU-owned providers (full sovereignty, smaller feature set). Picking the right point on this spectrum is a trade-off between capability and jurisdictional risk.
In regulated EU decisions, sovereign cloud is increasingly a dealbreaker rather than a criterion. DORA Art. 28, EBA outsourcing guidelines, BSI C5 and BaFin-regulated scopes all treat data residency plus operational control as non-negotiable for material workloads.
In practice
The decision interacts with every other cloud decision: IAM integration, exit strategy, log management, incident response. A memo that chooses sovereign cloud without mapping those downstream effects understates the real commitment.
Related terms
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
Zero Trust
A security model built on the principle that no user, device or network location is trusted by default. Access is continuously verified against identity, device posture, context and policy, regardless of whether the request comes from inside or outside the corporate network.
SASE
Gartner architecture category combining network (SD-WAN) and security functions (SWG, CASB, ZTNA, FWaaS, RBI) on a single cloud platform. SSE is the variant without SD-WAN.
SBOM
Machine-readable inventory of all components in a software incl. versions, licences and dependencies. Formats: SPDX, CycloneDX, SWID. Mandatory in regulated areas; in the US driven by Executive Order 14028.
Schrems II
CJEU ruling of 16 July 2020 that invalidated the EU-US Privacy Shield and only allowed Standard Contractual Clauses (SCC) under additional safeguards. Consequence: third-country data transfers need a Transfer Impact Assessment (TIA) plus additional protective measures.
SIEM (Security Information and Event Management)
A platform that centralises security logs, enables long-term retention, runs correlation rules and supports investigation. SIEM is the evidence layer under EDR, XDR and SOC operations and the single largest line item in most security budgets.
SOC 2 Type 2
Audit report by a US public accountant under AICPA SSAE 18 standard, confirming the operating effectiveness of a service organisation's controls over a period (typically 6-12 months). Refers to Trust Service Criteria.