Sovereign clouds, and which SaaS runs where

AWS, Microsoft, Google and Oracle, and partners built on their technology, now sell "sovereign" offerings for Europe, and each means something different by it. Below is what each one says about itself, from its own pages and dated. Then the other half of the question: which of the 124 SaaS vendors whose subprocessor lists we read actually run on those providers.

The offerings, in their providers' words

Each row shows the day we read it. A blank means the provider's pages we could read do not say. Where a page is not in English, we translate and mark it.

SAP's own sites disallow automated readers, so SAP's sovereign offerings are described here only through Delos Cloud, from Delos Cloud's own site. Official register entries (SecNumCloud, ENS) are on the certifications page.

Who operates it, under which law

A sovereign offering is usually run by a company set up for it, which is not always the company your contract is with, and not always the company that owns it. For the four offerings with an entry in the registry, each column below is one of those facts, in the operator's own words where it states them, read on 9 November 2026. SecNumCloud is France's cloud qualification, granted by ANSSI; the column shows what ANSSI's own lists say.

"Your contract is with" is the entity the provider's own terms or legal notice name, as on each registry entry. For AWS European Sovereign Cloud, that is Amazon Web Services EMEA SARL for accounts with an EU customer location, not the German operating company. The CLOUD Act column follows that entity and the parent the Global LEI Index records for it, as on theCLOUD Act page: where GLEIF has no record, it reads "not determined", whatever the owner's nationality, because we do not infer ownership. ANSSI publishes two lists: its catalogue of qualified services, and the providers in qualification that agreed to be named. A provider absent from both may still be in qualification without having said so.

What they say about foreign legal demands

The question behind most of this is whether a non-EU government can compel access to the data. These are the providers' own words; whether they hold is a legal question we do not answer. The ownership facts behind it are on the CLOUD Act page.

• AWS European Sovereign Cloud: Has resulted in zero disclosures of AWS enterprise or government customer content stored outside the U.S. to the U.S. government, since we started reporting the statistic in 2020. (source)
• Microsoft: the U.S. Congress enacted legislation that guarantees our right to object to U.S. law enforcement demands to access European data that conflict with EU law. (source)
• S3NS: in particular with regard to immunity from non-European extraterritorial laws (source)
• Bleu: Une entreprise française indépendante et protégée vis-à-vis des législations non‑européennes (source)
• STACKIT: You are safe from data access by unauthorized third parties (e.g. US authorities under the CLOUD Act). (source)

European cloud providers

The 13 infrastructure providers in the registry whose contracting entity has its seat in the EU, with what each publishes and what official registers record. 3 hold a SecNumCloud qualification on ANSSI's list and 2 a BSI certificate for ISO 27001 on the basis of IT-Grundschutz; 5 claim a BSI C5 attestation. A European seat is not a statement about every company in the chain: the parent column shows the parent the registry has recorded, and is blank where no register or page we read names one.

17 April 2026: the European Commission awarded its €180 million tender for sovereign cloud services for EU institutions. Its press release names Post Telecom with its partners CleverCloud and OVHcloud, STACKIT, Scaleway, and finally Proximus, which partners with S3NS (a joint venture of Thales and Google Cloud), Clarence and Mistral, selected based on their alignment with the Commission's Cloud Sovereignty Framework (IP/26/833, read 2026-11-09). It gives no level for any provider. In the registry: OVHcloud, STACKIT, Scaleway, S3NS, Mistral AI.

Only providers in the registry are listed; it is not a market survey. Certifications are what each provider's own pages claim, register entries what the authority's list holds. Where a provider is on the Data Privacy Framework list, that is a US transfer route it has certified, shown with the status the list gives.

Which SaaS vendors run on which cloud

From each vendor's own subprocessor list, re-read weekly. A vendor that names AWS for hosting may still keep EU customers' data in EU regions: the EU-location column says what it states about that. The grouping by use follows the purpose the vendor writes beside each name; hover a cell for the names it lists.

Sovereign offerings named in subprocessor lists today: Pennylane names S3NS for hosting its accredited e-invoicing platform, and Wire names Cloud Temple for its EU sovereign instance. Vendors with no list we could read are not in the table.

How this was read

The offerings were first read by hand on 19 October 2026 from the providers' own pages, after checking their robots.txt; the AWS, Bleu and Delos Cloud rows and the operator table were read again on 9 November 2026 through the registry's fetcher, which stores each page's text. They are not yet re-read automatically: a change to an offering appears here when the page is next reviewed. The vendor table comes from the weekly reading of subprocessor lists, the same rows each vendor page shows. Full method on the methodology page.