Data sovereignty for SMEs: where is your customer data actually stored?

You run an installation company with fifteen people. The mail runs at Microsoft, the quotes are in Dropbox and the planning is in an app whose name you keep forgetting. It works. Where all that data is stored, you have never needed to know.

Until a customer asks about it. A housing corporation, a municipality or a healthcare institution wants to know in a tender where you keep their data. Then you want to have a correct answer.

What data sovereignty means

Data sovereignty means that you decide what happens to your data. That depends on two things: where the data is stored, and which law applies to the party that keeps it for you.

That second point is often forgotten. An American company falls under the CLOUD Act from 2018, even if it keeps your data in a European data centre. US authorities can then request data through that company. The companies sometimes challenge that, but the legal uncertainty remains. That is no reason to panic. It is a reason to look into it once.

Why it affects you as a business owner

You may think this is something for ministries and hospitals. Yet it affects you in a few places:

• Your customers. Under the Cybersecurity Act, in force since 15 August 2026 (rijksoverheid.nl), many organisations must manage the risks in their supply chain. As their supplier, you are that chain.
• The GDPR. You are responsible for the personal data of your customers and employees, even if a supplier keeps it for you.
• Your dependence. If prices or terms change, you want to be able to switch without your business coming to a standstill.
• Your peace of mind. Knowing where your things are saves a lot of hassle in a data breach or with a difficult question from a customer.

Where do you start?

You do not have to turn everything upside down. Start with three data flows, because that is almost always where most of it is:

1. Your mail. Almost everything is here: quotes, contracts, customer questions and personal data.
2. Your files. Drawings, invoices, personnel files.
3. Your customer file. Names, addresses, appointments and sometimes more than that.

For each flow, look up who the supplier is, in which country the data is stored and which law the supplier falls under. This is usually in the data processing agreement or on a page with sub-processors. If it is not there, ask. A good supplier has that answer ready.

Also look at what your employees use themselves: a free translation service, an AI chat or a personal storage service. Data often disappears there unnoticed. Agree with each other what is and is not allowed, and offer an alternative that works just as easily.

An example

Suppose you want a maintenance contract with a housing corporation. The tender contains a question about tenant data. Where do you keep it, who has access and which sub-processors are there?

With three suppliers in three countries, that is an afternoon of research, with answers you are not entirely sure of. If your mail, files and contacts are in one place in the EU, you write the answer in two sentences. That saves time, and the buyer sees that you have it in order.

And if you want to switch?

Choose a supplier that answers these questions clearly. For each component you need, ask whether it works today. First test with a few colleagues before you cancel anything. Our guide to choosing a sovereign workplace helps you compare.

At Noveu, your data and backups are stored in a Hetzner data centre in Falkenstein, Germany, and Noveu is a Dutch company. Cloudflare (US) sits at the edge of the network. Mail, files, documents and contacts are live. You pay per month. The amounts and the conditions of any trial are on the pricing page.