Sovereign cloud in the EU:
more than an EU data centre.
A sovereign cloud is a cloud service where your data is stored in the EU, the provider falls under European law and you are free to switch. Below you can read what an EU region of a hyperscaler does and does not solve, and how Noveu does it.
Your data and backups are stored in a Hetzner data centre in Falkenstein, Germany. At the edge of the network we use Cloudflare (US).
Sovereignty is
three questions, not one.
In tenders and supplier conversations, digital sovereignty is often narrowed down to one question: is the data stored in Europe? That is a start, but it does not cover the concept.
Sovereignty is about control: knowing where your data is, knowing which law it falls under and keeping the freedom to make a different choice. If you can answer the three questions below, you know how sovereign a cloud service really is.
More background in the three questions for your suppliers (in Dutch) and in what Microsoft’s sovereign cloud solves and what it does not (in Dutch).
Where is your data?
Data location: the data centre where your information is physically stored. It matters for latency and for the transfer rules in the GDPR, but it is the first question, not the last.
Which law does your provider fall under?
Jurisdiction: the law that applies to the provider determines which governments can demand access to data. That law does not move along with the data centre.
Can you leave whenever you want?
Autonomy: open standards, exportable data and verifiable technology decide whether switching is a project or a hostage situation.
The EU region of a hyperscaler:
what it does and does not solve.
American cloud providers offer European regions and programmes such as the EU Data Boundary. That is serious work and it solves real problems. Just not all three questions.
What an EU region does settle
- Data locationYour data is physically stored in European data centres. For many residency requirements, that is a real improvement.
- PerformanceA shorter distance to European users means lower latency.
- Contractual commitmentsProgrammes such as the EU Data Boundary limit the default data flows to the United States.
What it does not change
- JurisdictionThe provider remains an American company. The CLOUD Act (2018) requires American providers, under an American court order, to hand over data they control, even when that data is stored in Europe.
- The conflict of lawsSuch an order can clash with Article 48 of the GDPR. Providers can resist, and they do, but that tension cannot be removed with a contract.
- DependencyPricing, roadmap and terms remain decisions of a non-European party, wherever the data centre is.
How Noveu answers
the three questions.
- Hosting
- Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein. A dedicated server at Hetzner, not a hyperscaler platform under the bonnet; at the edge of the network we use Cloudflare (US).
- Jurisdiction
- Noveu is a Dutch provider under Dutch and European law, without an American parent company.
- Open source
- The core infrastructure is built from open-source components such as PostgreSQL and Stalwart: verifiable. You retrieve your mail via IMAP, your calendar as .ics and documents as DOCX or PDF.
- Transparency
- Every sub-processor is listed publicly on the sub-processor list, including its role and location. No small print.
The providers in our chain.
At the edge we use Cloudflare, Inc. (US) for DNS, CDN, DDoS protection and TLS, under the EU-US Data Privacy Framework and SCCs. Mistral, a French company, supplies the AI generation layer; according to Mistral, that data is stored in the EU by default.
You can review our providers, their roles and locations on the public sub-processor list.
View the sub-processor list (in Dutch) →A sovereign cloud
in the Netherlands?
Many people search for a sovereign cloud in the Netherlands. Then it is good to be precise. Noveu is a Dutch company, under Dutch and European law. Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein. At the edge of the network we use Cloudflare (US).
Digital sovereignty
for businesses.
For a business, digital sovereignty mainly means: you know where your data is, who can access it and how you can leave again. You do not need an IT department for that. These four questions get you a long way:
- Where are your mail, files and backups stored, per service?
- Which law does the parent company of each supplier fall under?
- Can you export your data in an open format?
- Who else processes your data? Ask for the sub-processor list.
Comparing suppliers? Then use the seven questions for choosing a sovereign workplace (in Dutch).
Frequently asked questions
about sovereign cloud.
What is a sovereign cloud?
A sovereign cloud is a cloud service where not only is the data stored in Europe, but the provider also falls under European law, the technology is verifiable (for example open source) and the customer can take their data to another provider via open standards. Data location is therefore only one of the conditions.
Where does Noveu store my data?
Noveu is a Dutch company. Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein. At the edge of the network we use Cloudflare (US).
Is an EU data centre of an American provider a sovereign cloud?
Not in the strict sense. An EU region settles where the data is stored, but the provider remains an American company subject to American law, including the CLOUD Act. For many organisations an EU region is a perfectly good choice; if you also want to cover jurisdiction and dependency, you need more than data location alone.
What is the CLOUD Act?
The CLOUD Act is an American law from 2018 that requires American providers, on the basis of an American court order, to hand over data they control, even when that data is stored outside the United States. Providers can challenge such an order and these demands are rare, but the power exists independently of where a data centre is.
Want to know how sovereign
your environment is?
We go through the three questions with you for your current environment and show how Noveu Werkplek and Noveu Cloud do it differently.
This page is for information only and is not legal advice.