Sovereign cloud providers compared: AWS, Azure, Google, Oracle, OVHcloud, IONOS, T-Systems and more

The three terms describe different things. A private cloud is about who shares the hardware. A sovereign cloud is about who controls the service. A region is only about location.

A private cloud can be sovereign if an EU owner runs it with its own staff. A sovereign cloud is rarely private, since tenants still share its hardware. Data location alone is data residency, which our tracker of data residency requirements by country covers law by law.

A hyperscaler partition run in the EU. AWS, Microsoft and Oracle each run a sovereign offering through EU staff or EU subsidiaries (Amazon; Oracle FAQ). The parent company stays outside the EU. You get the full product range of the hyperscaler, or a large part of it.

US technology run by an EU partner. Google's Dedicated model is run in France by S3NS, a Thales company (S3NS). Microsoft's technology is run in France by Bleu, owned by Orange and Capgemini (Bleu). The partner holds the operations, and the software comes from the US vendor.

EU-owned providers. OVHcloud, IONOS, STACKIT, Scaleway and T-Systems build and run their own platforms (Commission, 17 April 2026). Their service lists are shorter than a hyperscaler's. Their owners and operators sit in the EU.

Which model fits is a question of legal exposure as much as features. Our guide to the EU sovereign ad tech stack explains why the owner of the operator matters for advertising data.

All statements are the providers' own unless the cell cites a certification body. "n/d" means we found no public statement. Each cell was checked on the last-updated date above.

The AWS answer to "sovereign cloud AWS" is a separate partition, not a setting in an existing region. Its first region opened in Brandenburg on 15 January 2026 under the code eusc-de-east-1 (Amazon, 15 January 2026). It uses its own resource-name partition, arn:aws-eusc (AWS docs).

Four German GmbH companies run it, and an advisory board of five EU citizens advises it (company claim) (aws.eu governance). AWS says only EU residents in the EU operate it today. It is "gradually transitioning" to EU citizens only (aws.eu FAQ).

Two points need care. The January press release called AWS's own framework audit "third-party validated", while the November FAQ says the region "is undergoing" an independent audit. Local Zones in Belgium, the Netherlands and Portugal were still described as "announced plans" on 6 November 2026 (aws.eu).

Microsoft offers two things under the "sovereign cloud Azure" label. The EU Data Boundary keeps customer data and personal data in the EU and EFTA. Microsoft completed its third phase in February 2025 (Microsoft, 26 February 2025). The boundary has stated exceptions, including "limited circumstances" where data still leaves it (Microsoft Learn).

The second is the Microsoft Sovereign Cloud package, announced on 16 June 2025. It has a Sovereign Public Cloud in existing EU regions and a Sovereign Private Cloud on Azure Local. Partner clouds are run by Bleu in France and by Delos Cloud, an SAP subsidiary, in Germany (Microsoft, 16 June 2025). In October 2026 Microsoft made external key management with Azure Managed HSM generally available. It said Data Guardian, its approval and logging control for remote access, was still rolling out (Microsoft, 20 October 2026).

Google sells three levels (Google Cloud, 21 May 2025). Data Boundary is the public cloud with location and access controls. Dedicated is a cloud run by a local partner. Air-Gapped is a disconnected system run by Google, the customer or a partner.

In France, S3NS runs Dedicated. It reached general availability on 16 October 2025 and SecNumCloud 3.2 on 17 December 2025 (S3NS). In Germany a Thales entity runs a preview, with general availability targeted for the end of 2026 (S3NS, 20 May 2026). T-Systems separately runs a Germany Data Boundary limited to one Google region.

Oracle's offer is the oldest in this table. Its release note says it became available on 31 July 2023 (Oracle). It runs in two regions, Frankfurt and Madrid, in a separate realm (Oracle docs). Oracle says customers outside the EU can also use it. Its certificate list is qualified with the words "upon completion of the applicable third-party audits", so the status of each one is unclear (Oracle FAQ).

These providers answer the ownership question by being EU companies. They differ on certificates and service depth.

OVHcloud has the broadest French qualification of the group. ANSSI lists three qualified services, including the SNC Cloud Platform from 31 July 2026 (ANSSI catalogue). OVHcloud dates the platform's qualification to September 2026, which differs from the ANSSI record.

IONOS received a C5 Type 1 attestation for 33 services on 28 May 2026, audited by PwC (IONOS). A Type 1 report checks control design at a point in time. A Type 2 report also tests how the controls worked over a period.

STACKIT belongs to the Schwarz Group and lists a C5 Type 2 attestation (STACKIT). Scaleway, part of iliad, says its SecNumCloud qualification is under way but "not yet granted" (Scaleway). Both reached SEAL-3 in the Commission's 2026 tender. T Cloud Public from T-Systems lists C5 Type II (T Cloud Public).

Three labels come up in every sovereign cloud tender. They test different things.

SecNumCloud is ANSSI's French qualification. It covers security and protection from non-EU law. ANSSI's decision for S3NS says the service offers protection against extra-European law (ANSSI decision). The table shows the cloud entries in the catalogue that matter for this comparison.

Source: ANSSI catalogue, updated 27 October 2026. Bleu, Scaleway and STACKIT do not appear in it.

C5 is the German BSI's criteria catalogue for cloud security, first published in 2016. The BSI says it was "completely revised in 2025/26", and auditors, not the BSI, issue the reports (BSI, 7 April 2026). C5 tests security controls; it says little about who owns the operator.

EUCS is the planned EU-wide cloud certification. It has not been adopted. The Commission says the work "is expected to resume", and that sovereignty gaps will be handled by other laws (European Commission). For now, the Commission's own buying uses its Cloud Sovereignty Framework and SEAL levels from SEAL-0 to SEAL-4 (Commission, 17 April 2026). Our explainer of the EU Cloud Sovereignty Framework covers the levels.

Ad tech puts unusual load on a sovereign cloud. A bidder must answer within the exchange's timeout, so it has to run close to the exchange. Bid logs grow fast, and audience data meets partner data in a clean room. Each of these is a place where the choice of provider shows up.

Example. An EU retailer runs offsite media from a bidder, a log store and a clean room. On a hyperscaler partition, all three can share one sovereign region, but the operator's parent stays outside the EU. On an EU-owned provider, the owner is European, but some managed services, such as a specific analytics engine, may be missing. On infrastructure it runs itself, the retailer controls every layer and takes on the operations. Our comparison of clean room architectures shows how the clean room choice changes who can query the data.

Key control matters most for data at rest and in transit. A bidding model still needs data in clear text while it scores a request. The self-hosted DSP infrastructure requirements page sizes the compute for that workload. For the trade-off between renting and running, see managed vs on-prem. The data sovereignty hub collects the rest.

These are buyer practices drawn from the gaps in the table above.

1. Which legal entity signs the contract, and which country is its parent in?
2. Which staff can reach production systems, and where do they live?
3. Can support access happen without your approval, and is each access logged where you can read it?
4. Where are the keys held, and can the provider decrypt without you?
5. Which services are inside the sovereign scope, and which run elsewhere?
6. Which certificates cover which services, with dates, auditor and report type?
7. Is a qualification issued or only in progress, and what does the public list say?
8. What happens to service if the link to the parent company is cut?
9. Which subprocessors and partners touch the data?
10. What will it cost and take to leave?

• A dated general availability notice for Microsoft's Sovereign Public Cloud or Sovereign Private Cloud.
• Delos Cloud's live status and certificates; its website did not load.
• Whether AWS's External Key Store works in the European Sovereign Cloud; the documentation does not list it as an exception, but no page confirms it.
• The dates and scope of most certificates listed by AWS, Oracle, OVHcloud and STACKIT.
• Key management and staff controls at IONOS, STACKIT and Scaleway.
• Whether Outscale's SecNumCloud qualification, which expires on 30 November 2026, will be renewed (ANSSI catalogue).

1. Amazon, "AWS launches AWS European Sovereign Cloud and announces expansion across Europe" (15 January 2026). https://press.aboutamazon.com/aws/2026/1/aws-launches-aws-european-sovereign-cloud-and-announces-expansion-across-europe
2. AWS European Sovereign Cloud, FAQ (updated 5 November 2026). https://aws.eu/faq/
3. AWS European Sovereign Cloud, Governance (updated 5 November 2026). https://aws.eu/governance/
4. AWS European Sovereign Cloud, Compliance (updated 5 November 2026). https://aws.eu/compliance/
5. AWS European Sovereign Cloud home page (updated 6 November 2026). https://aws.eu/
6. AWS documentation, AWS KMS in the AWS European Sovereign Cloud (undated, accessed 9 November 2026). https://docs.aws.eu/esc/latest/userguide/kms.html
7. Microsoft, "Announcing comprehensive sovereign solutions empowering European organizations" (16 June 2025). https://blogs.microsoft.com/blog/2025/06/16/announcing-comprehensive-sovereign-solutions-empowering-european-organizations/
8. Microsoft, "Microsoft completes landmark EU Data Boundary" (26 February 2025). https://blogs.microsoft.com/on-the-issues/2025/02/26/microsoft-completes-landmark-eu-data-boundary-offering-enhanced-data-residency-and-transparency/
9. Microsoft Learn, "What is the EU Data Boundary?" (page metadata 21 July 2026). https://learn.microsoft.com/en-us/privacy/eudb/eu-data-boundary-learn
10. Microsoft, "Advancing digital sovereignty with greater control and choice" (20 October 2026). https://blogs.microsoft.com/blog/2026/10/20/advancing-digital-sovereignty-with-greater-control-and-choice/