What is a sovereign cloud?

A cloud whose customer keeps meaningful control over three things: where data is stored and processed (data sovereignty), who can operate and access the systems (operational sovereignty), and which country’s laws can compel disclosure (legal or jurisdictional sovereignty). A server being in the EU covers only the first.

Does hosting in the EU make a cloud sovereign?

No. Location answers the data question only. A provider owned or controlled from outside the EU can still be subject to foreign law, for example the US CLOUD Act, which applies to data in a provider’s possession, custody or control regardless of location. That is why this guide scores ownership and jurisdiction separately from location.

Are the AWS, Microsoft and Google sovereign offerings really sovereign?

They address operations and data location in real ways: AWS runs dedicated EU legal entities with EU-resident operators, and S3NS is a Thales-controlled company running Google technology. Whether the remaining parent-company link is acceptable depends on your legal requirements and your counsel. This guide records the structure and does not rule on it.

What is the difference between C5, SecNumCloud and ISO 27001?

ISO/IEC 27001 certifies an information security management system. BSI C5 is a German criteria catalogue for cloud security, attested by an auditor, and says little about jurisdiction. SecNumCloud is a French state qualification of specific offers that also covers protection against non-EU extraterritorial law. They answer different questions and are not substitutes.

No. As of October 2026 the EU cloud certification scheme has not been adopted. The Commission’s January 2026 Cybersecurity Act revision says work is expected to resume, and its June 2026 Cloud and AI Development Act proposal includes a sovereignty framework, which is still going through the legislative process.

Is Swfte a sovereign cloud provider?

No. Swfte is a platform layer that runs on infrastructure you choose. Swfte Sovereign Deployment is a dedicated, region-pinned deployment of the platform; Swfte does not claim to operate its own data centres, and today the default location is AWS eu-west-1 (Ireland). Swfte lists its own offerings first on this page and says so in the disclosure at the top.

Did anyone pay to be on this list?

No. No provider paid for a place, a rating or a mention. The only placement that is not driven by the published score is Swfte’s own, which the publisher chose and discloses.

How often is this guide updated?

It carries a last-verified date (6 October 2026) and every provider lists its sources with the date each page was read. Certification and regulatory status changes quickly, so check the primary source before you sign.

Buyer's guide

Best sovereign cloud providers (2026)

Fourteen providers across European-owned clouds, hyperscaler sovereign programmes and GPU specialists, compared on facts the providers publish. Where we could not verify something, the page says so.

Last verified 6 October 2026

In short

Sovereignty is three questions, not one: where the data sits, who can operate the systems, and whose laws can compel access. EU hosting answers the first. Ownership and operating model answer the other two, and they are where providers differ most. No provider paid for a place on this page.

Build with AI Talk to our team

Read this first

How we rank

Four criteria, each rated 0 to 3 from a published fact, then combined with the weights below. A provider is scored only if all four criteria could be verified. If one could not, the provider is listed as unranked and the missing criterion says “not verified”. We do not fill gaps with a guess, and we do not compute a partial score.

Criterion	Weight	0	1	2	3
Jurisdiction and ownership	35%	Non-EU parent and no separation published.	Non-EU parent, with EU data-location commitments only (no EU legal entity or EU-resident operations published).	EU-incorporated operating entity under a non-EU parent, with published structural separation (EU legal entities, EU-resident operators).	EU-headquartered, with no non-EU parent in the ownership we could verify.
Published security attestations	25%	None published or found.	ISO/IEC 27001 only.	ISO/IEC 27001 plus at least one further named attestation or national qualification (SOC 2, BSI C5, TISAX, HDS, ACN and similar).	As 2, plus a national cloud-sovereignty qualification (SecNumCloud) or a BSI C5 Type 2 attestation stated by the provider.
GPU and AI services in Europe	20%	None found.	GPU compute or an AI service exists, but no data-centre GPU model is named on the provider page, or only workstation-class cards are offered.	Data-centre GPUs named (L4, L40S, A-series) with no managed AI service, or H100-class named without one.	H100-class or newer named, plus a managed inference or AI-endpoint service.
EU data-centre footprint	20%	No EU data centre found.	Data centres in one EU country.	Data centres in two or three EU countries.	Data centres in four or more EU countries.

The weights favour sovereignty and published evidence. They do not measure service breadth, price, support quality or performance, which may matter more to you.

The order on the page is: ranks 1 and 2 are Swfte’s own offerings, placed first by the publisher (they are not scored, and the disclosure above applies); the next providers are ordered by score; the rest are unranked and listed alphabetically. Certification claims are the provider’s own, linked to the page we read. Where a provider page could not be fetched we say that we read a search summary of it. For SecNumCloud in particular, check the ANSSI catalogue: we could not read it directly.

Definitions

What “sovereign cloud” means, and what it does not

Data sovereignty is control over where data is stored and processed. Operational sovereignty is control over who can administer the systems and whether they can be run without outside help. Legal or jurisdictional sovereignty is protection from foreign law that could compel disclosure: the US CLOUD Act, for example, covers data in a provider’s possession, custody or control regardless of where it is stored. A cloud can be strong on the first and weak on the third.

Frameworks and schemes you will meet in a procurement, with their status as of 6 October 2026:

Framework	What it is	Status
EU Cloud Sovereignty Framework	The European Commission’s method for assessing the sovereignty of cloud services in procurement: eight sovereignty objectives and a five-level SEAL (Sovereignty Effectiveness Assurance Level) scale.	In use in the Commission’s Cloud III tender; the Commission awarded a EUR 180 million contract to four providers in April 2026.
EUCS (EU cloud certification scheme)	A proposed EU cybersecurity certification scheme for cloud services under the Cybersecurity Act, drafted by ENISA.	Not adopted. The Commission’s Q&A on its January 2026 Cybersecurity Act revision says EUCS work is expected to resume.
EU Cloud and AI Development Act (CADA)	A Commission proposal for a regulation to strengthen EU cloud and AI infrastructure, including a single framework for assessing cloud and AI sovereignty.	Proposed 3 June 2026 (COM(2026) 502). Still in the legislative procedure; no adoption found.
Gaia-X	A European initiative with a Trust Framework and a three-level label scheme for cloud services.	The label scheme is live with services being assessed and listed (Gaia-X, 12 June 2026). Current number of labelled services not verified.
BSI C5	The German Federal Office for Information Security’s criteria catalogue for cloud security, used as the basis for attestation reports. It is a security attestation, not a sovereignty test.	C5:2026 has been published (April 2026); C5:2020 remains in use during the transition. Transition dates were not confirmed on a BSI page we could read.
ANSSI SecNumCloud	The French national security qualification for specific cloud offers, including protection against non-EU extraterritorial law.	Version 3.2. ANSSI’s providers page lists many providers as in qualification. We could not read the authoritative list of qualified offers, so check the ANSSI catalogue before relying on any provider’s claim.
Spain ENS	The Spanish national security scheme for the public sector and its suppliers (Real Decreto 311/2022) with BASICA, MEDIA and ALTA categories.	In force since 5 May 2022. MEDIA and ALTA need a conformity audit. We did not find a single list of ENS-certified cloud providers.
US CLOUD Act	A 2018 US law that amended the Stored Communications Act so that providers must disclose data in their possession, custody or control regardless of where it is stored, and that allows executive agreements with foreign governments.	In force since March 2018. The US Department of Justice lists agreements with the UK, Australia, Canada and the EU.

At a glance

Comparison table

#	Provider	Type	Headquarters	Regions	GPU and AI	Score
1	Swfte Sovereign Deployment	Platform layer (publisher)	Swfte platform; infrastructure provider agreed per deployment	Customer data is in AWS eu-west-1 (Ireland) today. Other locations are agreed per dedicated deployment (Swfte trust page).	GPU model and capacity depend on the infrastructure chosen per deployment. <GPU models offered — founder to fill>	Not scored (placed by publisher)
2	Swfte Light Cloud	Platform layer (publisher)	Swfte platform	<regions — founder to fill>	Lower-cost environment; GPU type assigned by availability rather than specified. GPU models: <GPU models — founder to fill>.	Not scored (placed by publisher)
3	OVHcloud	European-owned cloud	France	Provider pages cite 46 data centres in 9 countries (counts vary by page). European sites: France, Germany (Frankfurt), Italy (Milan), Poland (Warsaw), UK (London). Data centres also outside Europe.	NVIDIA H200, H100, V100S, A10, L40S, L4. AI Endpoints (serverless model API), AI Deploy, AI Training.	100 / 100
4	Scaleway	European-owned cloud	France	Paris (3 AZ), Amsterdam (3 AZ), Warsaw (3 AZ), Milan (1 AZ).	B300-SXM, H100-SXM, H100 PCIe, L40S, L4 (by region: Paris has all five; Warsaw L40S, L4, H100 PCIe; none in Amsterdam or Milan). Generative APIs, Managed Inference, GPU Clusters.	91.7 / 100
5	Outscale (Dassault Systèmes)	European-owned cloud	France	Paris-area regions including a SecNumCloud region (cloudgouv-eu-west-1); also US and Japan regions.	NVIDIA H100 flexible GPU in eu-west-2 and the SecNumCloud region; LLMaaS with Mistral AI models in the SecNumCloud region.	86.7 / 100
6	IONOS Cloud	European-owned cloud	Germany	Frankfurt, Berlin, Paris, Logroño (Spain), plus London, Worcester and US sites.	NVIDIA H200 Cloud GPU VMs (up to 8 GPUs), Frankfurt only. AI Model Hub (managed inference, OpenAI-compatible), Berlin only.	85 / 100
7	STACKIT (Schwarz Digits)	European-owned cloud	Germany (Bad Friedrichshall)	Seven data centres in Germany and Austria; regions eu01 (Germany) and eu02 (Austria), at least three AZ each.	Compute Engine with GPU and AI Model Serving; GPU models not named on the pages we read.	80 / 100
8	T Cloud Public (formerly Open Telekom Cloud)	European-owned cloud	Germany	Germany (Magdeburg/Biere), Netherlands (Amsterdam), Switzerland; two physical data centres per region.	GPU instances offered, models not named on the page. A separate Industrial AI Cloud in Munich with 10,000 NVIDIA GPUs is described in Telekom press material.	71.7 / 100
9	AWS European Sovereign Cloud	Hyperscaler sovereign programme	Parent: United States. Region: Brandenburg, Germany	One region (eusc-de-east-1, Brandenburg); sovereign Local Zones planned in Belgium, the Netherlands and Portugal.	SageMaker and Bedrock named among available services; GPU instance types not stated in the source we read.	53.3 / 100
10	Aruba Cloud	European-owned cloud	Italy	Italy (Arezzo, Ponte San Pietro, Rome) plus Czech Republic and partner sites.	NVIDIA L40S (GPU on Demand for Kubernetes) and RTX cards in dedicated servers; no H100 named.	Unranked: a criterion is not verified
11	Exoscale (A1 Digital)	European-owned cloud	Switzerland (Akenes SA, Lausanne)	Frankfurt, Munich, Vienna, Geneva, Zurich, Sofia, Zagreb, Madrid.	1 to 8 NVIDIA cards per instance, models not named on the page. Dedicated and on-demand inference (OpenAI-compatible).	Unranked: a criterion is not verified
12	Google Cloud sovereign offerings (incl. S3NS)	Hyperscaler sovereign programme	Parent: United States. S3NS: France	S3NS PREMI3NS: France. A Germany Dedicated tier with Thales was in preview as of June 2026 with general availability planned for the end of 2026.	Not verified for the sovereign tiers.	Unranked: a criterion is not verified
13	Hetzner	European-owned cloud	Germany	Nuremberg, Falkenstein (Germany), Helsinki (Finland); also Ashburn, Hillsboro and Singapore.	Dedicated GPU servers with NVIDIA RTX PRO 6000 Blackwell and RTX-class cards; no H100 or H200 and no managed AI endpoint found.	Unranked: a criterion is not verified
14	Microsoft Sovereign Cloud	Hyperscaler sovereign programme	Parent: United States	Public Cloud follows the EU Data Boundary; partner clouds are national. Region list not verified.	Foundry Local runs large models in disconnected Private Cloud, for qualified customers only. GPU offerings not verified.	Unranked: a criterion is not verified
15	Mistral Compute	GPU / AI specialist	not verified	Provider says EU soil only; a Les Ulis (Essonne) inference site is scheduled for Q3 2026 (search summary).	No GPU models named on the page; managed Slurm and Kubernetes; capacity by contacting sales.	Unranked: a criterion is not verified
16	Nebius	GPU / AI specialist	Netherlands (Amsterdam)	Finland and Paris in Europe (via Nebius posts); also UK, Israel and the US.	NVIDIA GB200 NVL72 (first general availability in Europe, June 2025), B200, H200, H100, L40S.	Unranked: a criterion is not verified

Swfte’s two entries come first because the publisher placed them there. They are not independently measured.

Provider by provider

What each provider publishes

#1 · Platform layer (publisher) · placed by the publisher

Swfte Sovereign Deployment

Best for: Organizations that want the Swfte platform (Studio, Connect, Cortex, governed agents) running as a dedicated, region-pinned deployment on infrastructure they choose, rather than a shared multi-tenant service.

Headquarters: Swfte platform; infrastructure provider agreed per deployment. Ownership: Swfte does not claim to own data centres: the jurisdiction profile is that of the infrastructure underneath.

Regions: Customer data is in AWS eu-west-1 (Ireland) today. Other locations are agreed per dedicated deployment (Swfte trust page).

GPU and AI: GPU model and capacity depend on the infrastructure chosen per deployment. <GPU models offered — founder to fill>

Certifications as stated by the provider:

No SOC 2 report, ISO 27001 certificate or HIPAA BAA today; a SOC 2 Type I audit is in preparation. Current status: Swfte trust page. (source)

Watch-outs:

A platform layer, not an infrastructure owner: Swfte does not claim to operate its own data centres. Sovereignty properties come from the infrastructure underneath.
eu-west-1 is an AWS region, so today the jurisdiction profile of the default location is that of AWS in Ireland. Stricter jurisdiction needs a different location, agreed per deployment.
Dedicated deployments are scoped with Swfte, not self-serve. Customer-managed encryption keys are designed for dedicated deployments and not generally available today.
Swfte does not claim to be “GDPR compliant” or “EU AI Act compliant”. It provides technical controls, governance mechanisms and evidence; the exact posture depends on your use case, jurisdiction, deployment and configuration.

#2 · Platform layer (publisher) · placed by the publisher

Swfte Light Cloud

Best for: The budget option next to Swfte Sovereign Deployment: development, testing and non-critical workloads where cost matters more than control over the GPU type.

Headquarters: Swfte platform. Ownership: <ownership and hosting provider — founder to fill>

Regions: <regions — founder to fill>

GPU and AI: Lower-cost environment; GPU type assigned by availability rather than specified. GPU models: <GPU models — founder to fill>.

Certifications as stated by the provider: not verified

Watch-outs:

Less control over GPU type, so not the pick for latency-critical or tightly specified workloads.
Regions, pricing, SLAs, isolation level, data residency and certifications: <to be supplied — founder to fill>. No sovereignty guarantee is implied for this option.

#3 · European-owned cloud

OVHcloud

Best for: Buyers who want a European-owned provider with SecNumCloud-qualified options and a broad catalogue including GPUs and a managed model API.

Headquarters: France. Ownership: Listed on Euronext Paris. The Klaba family holds 79.0% of capital and 79.6% of votes (5 December 2025); free float 18.4%. No non-EU parent.

Regions: Provider pages cite 46 data centres in 9 countries (counts vary by page). European sites: France, Germany (Frankfurt), Italy (Milan), Poland (Warsaw), UK (London). Data centres also outside Europe.

GPU and AI: NVIDIA H200, H100, V100S, A10, L40S, L4. AI Endpoints (serverless model API), AI Deploy, AI Training.

Certifications as stated by the provider:

ISO/IEC 27001, 27017, 27018, 27701; SOC 1/2/3; HDS (compliance hub) (source) Page not directly readable; read via a search summary.
SecNumCloud-qualified VMware private cloud (dedicated sites) (source) Page not directly readable; read via a search summary.

Watch-outs:

SecNumCloud applies to specific offers, not the whole public cloud. The ANSSI providers page we read still lists “SNC Cloud Platform” as in qualification, while third-party sources say it was qualified on 1 September 2026: confirm on the ANSSI catalogue.
Data centres exist outside the EU, and the ISO scope on the page we read excludes the US.

Score 100 out of 100. Jurisdiction and ownership: Listed French group, family-controlled, no non-EU parent. Published security attestations: ISO family plus SOC and HDS on its pages, and SecNumCloud-qualified offers per OVHcloud and third-party lists (ANSSI catalogue not read by us). GPU and AI services in Europe: H200 and H100 named; AI Endpoints is a managed service. EU data-centre footprint: France, Germany, Italy and Poland.

#4 · European-owned cloud

Scaleway

Best for: Teams that want current-generation GPUs and managed inference from a French provider, with Paris and Warsaw capacity.

Headquarters: France. Ownership: Subsidiary of the iliad Group; describes itself as 100% European-owned. Shareholding chain not on the pages we read.

Regions: Paris (3 AZ), Amsterdam (3 AZ), Warsaw (3 AZ), Milan (1 AZ).

GPU and AI: B300-SXM, H100-SXM, H100 PCIe, L40S, L4 (by region: Paris has all five; Warsaw L40S, L4, H100 PCIe; none in Amsterdam or Milan). Generative APIs, Managed Inference, GPU Clusters.

Certifications as stated by the provider:

ISO/IEC 27001:2022 and HDS listed. SecNumCloud shown as qualification in progress, not granted. (source)

Watch-outs:

SecNumCloud is not yet granted on the pages we read; ANSSI lists “Scaleway SecNumCloud (IaaS, PaaS)” as in qualification.
GPU capacity is concentrated in Paris and Warsaw.
SOC 2 and C5 are not on the page we read.

Score 91.7 out of 100. Jurisdiction and ownership: French group (iliad), self-described European-owned. Published security attestations: ISO 27001:2022 and HDS; SecNumCloud pending. GPU and AI services in Europe: B300 and H100 named; Generative APIs and Managed Inference. EU data-centre footprint: France, Netherlands, Poland and Italy.

#5 · European-owned cloud

Outscale (Dassault Systèmes)

Best for: French public-sector and regulated buyers that need a SecNumCloud-qualified IaaS with GPU access.

Headquarters: France. Ownership: Dassault Systèmes became majority shareholder in December 2017; Dassault Systèmes is listed in France.

Regions: Paris-area regions including a SecNumCloud region (cloudgouv-eu-west-1); also US and Japan regions.

GPU and AI: NVIDIA H100 flexible GPU in eu-west-2 and the SecNumCloud region; LLMaaS with Mistral AI models in the SecNumCloud region.

Certifications as stated by the provider:

SecNumCloud 3.2; HDS; ISO 27001/27017/27018 (Dassault Systèmes press page) (source) Page not directly readable; read via a search summary.

Watch-outs:

SecNumCloud covers the cloudgouv region only. A third-party tracker (15 September 2026) shows the IaaS qualification valid until 30 November 2026, so renewal is due; confirm on the ANSSI catalogue.
Only France in the EU. H100 is priced higher in the SecNumCloud region.

Score 86.7 out of 100. Jurisdiction and ownership: French listed parent, no non-EU parent. Published security attestations: SecNumCloud 3.2, HDS and ISO per Dassault Systèmes and third-party lists. GPU and AI services in Europe: H100 named; LLMaaS is a managed service. EU data-centre footprint: EU data centres in France only.

#6 · European-owned cloud

IONOS Cloud

Best for: German and EU buyers wanting a C5-attested provider with H200 capacity and a managed model hub.

Headquarters: Germany. Ownership: IONOS Group SE, listed in Frankfurt; United Internet AG held 63.8% at 31 December 2025. No non-EU parent; operating entities also exist in the US.

Regions: Frankfurt, Berlin, Paris, Logroño (Spain), plus London, Worcester and US sites.

GPU and AI: NVIDIA H200 Cloud GPU VMs (up to 8 GPUs), Frankfurt only. AI Model Hub (managed inference, OpenAI-compatible), Berlin only.

Certifications as stated by the provider:

BSI C5 Type 1 (November 2023) for Compute Engine, Cloud Cubes and S3 Object Storage; IT-Grundschutz since September 2022 (source)
ISO 27001 data centres (source)

Watch-outs:

The C5 report we found is a 2023 Type 1 covering three services; current scope not verified.
H200 VMs only in Frankfurt and the default quota is one H200-S VM; AI Model Hub only in Berlin.

Score 85 out of 100. Jurisdiction and ownership: German listed parent; US subsidiaries noted. Published security attestations: ISO 27001 plus C5 Type 1; not Type 2. GPU and AI services in Europe: H200 named; AI Model Hub is a managed service. EU data-centre footprint: Germany, France and Spain.

#7 · European-owned cloud

STACKIT (Schwarz Digits)

Best for: German and Austrian public-sector and regulated buyers who want German-only hosting and broad published attestations.

Headquarters: Germany (Bad Friedrichshall). Ownership: Brand of Schwarz Digits, the IT arm of the Schwarz Group (Lidl, Kaufland); the provider states it does not depend on outside investors. Operating entity renamed Schwarz Digits Cloud GmbH & Co. KG in 2026.

Regions: Seven data centres in Germany and Austria; regions eu01 (Germany) and eu02 (Austria), at least three AZ each.

GPU and AI: Compute Engine with GPU and AI Model Serving; GPU models not named on the pages we read.

Certifications as stated by the provider:

BSI C5 Type 2; ISAE 3000 (SOC 2); ISAE 3402; ISO 27001/27017/27018; TISAX Level 3 (source)

Watch-outs:

Only two countries and about 40 services, far fewer than a hyperscaler.
C5 Type 2 applies to a listed set of products only.
GPU models not named on the pages we read.

Score 80 out of 100. Jurisdiction and ownership: German group, no outside investors stated. Published security attestations: C5 Type 2 stated by the provider, plus ISO and TISAX. GPU and AI services in Europe: AI service exists; no GPU model named. EU data-centre footprint: Germany and Austria.

#8 · European-owned cloud

T Cloud Public (formerly Open Telekom Cloud)

Best for: Buyers wanting a Deutsche Telekom-operated cloud with German hosting and a sovereignty-by-design positioning.

Headquarters: Germany. Ownership: Operated by T-Systems International GmbH, part of the Deutsche Telekom group. Renamed from Open Telekom Cloud in January 2026.

Regions: Germany (Magdeburg/Biere), Netherlands (Amsterdam), Switzerland; two physical data centres per region.

GPU and AI: GPU instances offered, models not named on the page. A separate Industrial AI Cloud in Munich with 10,000 NVIDIA GPUs is described in Telekom press material.

Certifications as stated by the provider:

ISO 27001/27017/27018, TISAX, BSI C5, DORA support, §203 StGB support (attestation type not stated on page) (source)

Watch-outs:

Only three regions. Telekom says it offers about 80 percent of the core functions of US hyperscalers.
The provider’s own statement that CLOUD Act access is “not possible” is a marketing claim, not a legal finding.
IT-Grundschutz application filed in July 2025 and still in progress.

Score 71.7 out of 100. Jurisdiction and ownership: German telecom group. Published security attestations: ISO, TISAX and C5 (type not stated). GPU and AI services in Europe: GPU service exists; no model named on the cloud page. EU data-centre footprint: Germany and the Netherlands in the EU.

#9 · Hyperscaler sovereign programme

AWS European Sovereign Cloud

Best for: Organizations already on AWS that want EU-resident operation, an EU legal-entity wrapper and a familiar service catalogue.

Headquarters: Parent: United States. Region: Brandenburg, Germany. Ownership: Run by dedicated European legal entities under German law with EU-citizen managing directors; customers contract via Amazon Web Services EMEA SARL. The entities sit within the Amazon group, so the parent is a US company. That is an ownership-structure fact, not legal advice.

Regions: One region (eusc-de-east-1, Brandenburg); sovereign Local Zones planned in Belgium, the Netherlands and Portugal.

GPU and AI: SageMaker and Bedrock named among available services; GPU instance types not stated in the source we read.

Certifications as stated by the provider:

ISO/IEC 27001:2013, SOC 1/2/3 and a BSI C5 attestation named by AWS at launch (source)

Watch-outs:

Generally available since 14 January 2026, in one German region at launch.
US parent: whether the structure meets your legal requirements is for your counsel, not a rating on this page.

Score 53.3 out of 100. Jurisdiction and ownership: EU legal entities and EU-resident operators published; US parent. Published security attestations: ISO 27001, SOC and a C5 attestation named; type not stated. GPU and AI services in Europe: Managed AI services listed; no GPU model named. EU data-centre footprint: Germany only.

#10 · European-owned cloud · unranked, a criterion is not verified

Aruba Cloud

Best for: Italian public-administration and regulated buyers who need an ACN-qualified cloud.

Headquarters: Italy. Ownership: not verified

Regions: Italy (Arezzo, Ponte San Pietro, Rome) plus Czech Republic and partner sites.

GPU and AI: NVIDIA L40S (GPU on Demand for Kubernetes) and RTX cards in dedicated servers; no H100 named.

Certifications as stated by the provider:

Italian national cybersecurity agency (ACN) register: Aruba Cloud Pro, qualification level 1, valid until 16 January 2028 (source)

Watch-outs:

Ownership and a primary ISO page were not verified (the page returned 404).
High-end GPUs are by custom quote only.

#11 · European-owned cloud · unranked, a criterion is not verified

Exoscale (A1 Digital)

Best for: Buyers who want broad EU city coverage and Swiss or Austrian parentage with managed inference.

Headquarters: Switzerland (Akenes SA, Lausanne). Ownership: Member of A1 Digital, part of the A1 Group. The ultimate parent is not shown on the pages we read.

Regions: Frankfurt, Munich, Vienna, Geneva, Zurich, Sofia, Zagreb, Madrid.

GPU and AI: 1 to 8 NVIDIA cards per instance, models not named on the page. Dedicated and on-demand inference (OpenAI-compatible).

Certifications as stated by the provider:

ISO 27001/27017/27018, BSI C5, SOC 2, HDS, CSA STAR, TISAX listed (attestation types and periods not shown) (source)

Watch-outs:

Ultimate parent of the A1 Group not verified, so jurisdiction is unrated.
Datacentre partner certifications vary by zone; the A1 Digital claim of exemption from the US CLOUD Act is the provider’s statement.

#12 · Hyperscaler sovereign programme · unranked, a criterion is not verified

Google Cloud sovereign offerings (incl. S3NS)

Best for: Buyers who want Google services under a French-controlled, SecNumCloud-qualified operator, or an air-gapped Google stack.

Headquarters: Parent: United States. S3NS: France. Ownership: Three tiers: Data Boundary, Dedicated (partner-operated) and Air-Gapped (Google Distributed Cloud). S3NS is a French-law company that S3NS states is fully controlled by Thales, running Google technology.

Regions: S3NS PREMI3NS: France. A Germany Dedicated tier with Thales was in preview as of June 2026 with general availability planned for the end of 2026.

GPU and AI: Not verified for the sovereign tiers.

Certifications as stated by the provider:

S3NS PREMI3NS qualified SecNumCloud 3.2 on 17 December 2025 (IaaS, CaaS, PaaS) (source) Page not directly readable; read via a search summary.

Watch-outs:

Germany Dedicated is not yet generally available; the preview and date come from a secondary report (heise).
GPU and AI availability on the sovereign tiers was not verified.

#13 · European-owned cloud · unranked, a criterion is not verified

Hetzner

Best for: Cost-sensitive teams that want German or Finnish hosting and a C5 Type 2 attestation, and will run their own stack.

Headquarters: Germany. Ownership: not verified

Regions: Nuremberg, Falkenstein (Germany), Helsinki (Finland); also Ashburn, Hillsboro and Singapore.

GPU and AI: Dedicated GPU servers with NVIDIA RTX PRO 6000 Blackwell and RTX-class cards; no H100 or H200 and no managed AI endpoint found.

Certifications as stated by the provider:

ISO/IEC 27001:2022 for the Germany and Finland parks (source)
BSI C5:2020 Type 2 attestation for cloud services (technical and organisational measures page) (source)

Watch-outs:

Ownership was not stated on the pages we read, so jurisdiction is unrated.
The ISO scope covers Germany and Finland only. GPU is dedicated servers, with no hyperscale-style managed services.

#14 · Hyperscaler sovereign programme · unranked, a criterion is not verified

Microsoft Sovereign Cloud

Best for: Microsoft-centric estates that need a choice between a public, a private or a national-partner operating model.

Headquarters: Parent: United States. Ownership: Umbrella over three models: Sovereign Public Cloud (Microsoft-operated within the EU Data Boundary), Sovereign Private Cloud (Azure Local and related products) and National Partner Clouds (Bleu in France, Delos in Germany). Properties differ by model.

Regions: Public Cloud follows the EU Data Boundary; partner clouds are national. Region list not verified.

GPU and AI: Foundry Local runs large models in disconnected Private Cloud, for qualified customers only. GPU offerings not verified.

Certifications as stated by the provider: not verified

Watch-outs:

Properties vary by model, so no single rating applies; we leave it unranked.
Azure Local disconnected operations were announced available on 24 February 2026; ANSSI lists Bleu SAS as in SecNumCloud qualification.

#15 · GPU / AI specialist · unranked, a criterion is not verified

Mistral Compute

Best for: Teams that want sales-led, EU-located capacity from a model lab.

Headquarters: not verified. Ownership: not verified

Regions: Provider says EU soil only; a Les Ulis (Essonne) inference site is scheduled for Q3 2026 (search summary).

GPU and AI: No GPU models named on the page; managed Slurm and Kubernetes; capacity by contacting sales.

Certifications as stated by the provider: not verified

Watch-outs:

No certifications named; legal name and headquarters not verified on the pages we read.
The regional endpoints post notes limited transfers to sub-processors that may be outside the chosen region.

#16 · GPU / AI specialist · unranked, a criterion is not verified

Nebius

Best for: AI teams that want the newest NVIDIA capacity from a European-headquartered provider.

Headquarters: Netherlands (Amsterdam). Ownership: Nebius B.V.; listed parent Nebius Group N.V. on Nasdaq (NBIS).

Regions: Finland and Paris in Europe (via Nebius posts); also UK, Israel and the US.

GPU and AI: NVIDIA GB200 NVL72 (first general availability in Europe, June 2025), B200, H200, H100, L40S.

Certifications as stated by the provider: not verified

Watch-outs:

No certifications on the pages we read; check its trust centre.
Positioned as EU-headquartered with EU data-residency options, not as a sovereignty-certified cloud.

Decision guide

How to choose

You must keep data out of reach of non-EU law (public sector, defence, critical operators). Start with EU-headquartered providers that have no non-EU parent, and with qualifications such as SecNumCloud (France) or C5 Type 2 plus a German operator. Ask for the ownership chain in writing.
You need current-generation GPUs for training or high-volume inference in Europe. Compare OVHcloud, Scaleway, IONOS and Nebius on named GPU models and on which region holds the capacity, then ask for committed capacity in writing.
You are already deep in AWS, Microsoft or Google tooling. Evaluate the hyperscaler sovereign programmes, and have counsel assess the parent-company link against your actual legal requirement.
You want to run the same AI platform on whichever infrastructure satisfies your policy. Separate the two decisions: choose the infrastructure for jurisdiction, then run a platform such as Swfte’s dedicated deployment on top. See the section on where Swfte fits.
Cost and simplicity matter most and the data is not highly sensitive. Look at Hetzner or a lower-cost environment, and check the attestations match your auditor’s expectations.

Before signing, ask every shortlisted provider for these in writing:

The full ownership chain up to the ultimate parent, and which entity signs your contract.
Which staff, in which countries, can access your systems and under what approval.
The scope (offers, regions, dates) of each certification, not the logo.
How a government data request would be handled, and how you would be told.
Exit terms: how you get your data and configuration out, and in what format.

Where Swfte fits

Swfte is a platform layer, not a data-centre owner

Swfte publishes this guide and lists its own offerings first, as disclosed at the top. Swfte Sovereign Deployment is a dedicated, in-region or in-country deployment of the Swfte platform on infrastructure agreed per deployment. Customer data is in AWS eu-west-1 (Ireland) today, per the trust page; other locations are agreed per dedicated deployment. Swfte does not claim to operate its own data centres, so the jurisdiction you get is the one of the infrastructure underneath. You can choose a provider from the list above and run the platform on top. See sovereign infrastructure, dedicated cloud, GPU and Swfte in the EU.

The second Swfte entry is a lower-cost option for development, testing and non-critical work, where the GPU type is assigned by availability rather than specified. Its regions, pricing, SLAs, isolation level, residency and certifications are not yet published and show as founder-to-fill placeholders in the provider notes. No sovereignty guarantee is implied for it.

Build with AI Talk to our team

Evidence

Sources, last verified 6 October 2026

Every link was read on 6 October 2026 unless a note says otherwise. Providers change certifications and regions often: treat this as a starting shortlist and confirm on the primary source before signing.

European Commission: sovereign cloud framework explained (read 2026-10-06)
European Commission: CADA proposal (read 2026-10-06)
US Department of Justice: CLOUD Act resources (read 2026-10-06)
Swfte trust page (read 2026-10-06)
Swfte sovereignty platform page (read 2026-10-06)
Swfte dedicated cloud page (read 2026-10-06)
OVHcloud GPU instances (read 2026-10-06)
OVHcloud shareholders and governance (read 2026-10-06)
ANSSI: providers in SecNumCloud qualification (read 2026-10-06)
Scaleway security and compliance (read 2026-10-06)
Scaleway GPU instances (read 2026-10-06)
Scaleway product availability by region (read 2026-10-06)
Dassault Systèmes: Outscale and sovereignty (read 2026-10-06)
Outscale flexible GPUs documentation (read 2026-10-06)
IONOS C5 announcement (read 2026-10-06)
IONOS Cloud GPU VM documentation (read 2026-10-06)
IONOS data centres (read 2026-10-06)
STACKIT certificates (read 2026-10-06)
STACKIT facts (read 2026-10-06)
T Cloud Public: sovereignty (read 2026-10-06)
T Cloud Public: new name for Open Telekom Cloud (read 2026-10-06)
Telekom: Industrial AI Cloud launch (read 2026-10-06)
AWS: opening the AWS European Sovereign Cloud (read 2026-10-06)
Microsoft Sovereign Cloud overview (read 2026-10-06)
Microsoft: Sovereign Cloud adds disconnected operations (24 Feb 2026) (read 2026-10-06)
Google Cloud sovereign cloud (read 2026-10-06)
S3NS: PREMI3NS SecNumCloud qualification (read 2026-10-06)
heise: Google Sovereign Cloud in Germany by end of 2026 (read 2026-10-06)
Hetzner certifications (read 2026-10-06)
Hetzner technical and organisational measures (read 2026-10-06)
Exoscale compliance (read 2026-10-06)
A1 Digital: European cloud (read 2026-10-06)
ACN: Aruba Cloud Pro qualification (read 2026-10-06)
Aruba Cloud GPU on Demand (read 2026-10-06)
Nebius: first Blackwell general availability in Europe (read 2026-10-06)
Nebius about (read 2026-10-06)
Mistral Compute (read 2026-10-06)
Mistral: regional inference and new compute (read 2026-10-06)

Common questions

What is a sovereign cloud?: A cloud whose customer keeps meaningful control over three things: where data is stored and processed (data sovereignty), who can operate and access the systems (operational sovereignty), and which country’s laws can compel disclosure (legal or jurisdictional sovereignty). A server being in the EU covers only the first.
Does hosting in the EU make a cloud sovereign?: No. Location answers the data question only. A provider owned or controlled from outside the EU can still be subject to foreign law, for example the US CLOUD Act, which applies to data in a provider’s possession, custody or control regardless of location. That is why this guide scores ownership and jurisdiction separately from location.
Are the AWS, Microsoft and Google sovereign offerings really sovereign?: They address operations and data location in real ways: AWS runs dedicated EU legal entities with EU-resident operators, and S3NS is a Thales-controlled company running Google technology. Whether the remaining parent-company link is acceptable depends on your legal requirements and your counsel. This guide records the structure and does not rule on it.
What is the difference between C5, SecNumCloud and ISO 27001?: ISO/IEC 27001 certifies an information security management system. BSI C5 is a German criteria catalogue for cloud security, attested by an auditor, and says little about jurisdiction. SecNumCloud is a French state qualification of specific offers that also covers protection against non-EU extraterritorial law. They answer different questions and are not substitutes.
Is EUCS in force?: No. As of October 2026 the EU cloud certification scheme has not been adopted. The Commission’s January 2026 Cybersecurity Act revision says work is expected to resume, and its June 2026 Cloud and AI Development Act proposal includes a sovereignty framework, which is still going through the legislative process.
Is Swfte a sovereign cloud provider?: No. Swfte is a platform layer that runs on infrastructure you choose. Swfte Sovereign Deployment is a dedicated, region-pinned deployment of the platform; Swfte does not claim to operate its own data centres, and today the default location is AWS eu-west-1 (Ireland). Swfte lists its own offerings first on this page and says so in the disclosure at the top.
Did anyone pay to be on this list?: No. No provider paid for a place, a rating or a mention. The only placement that is not driven by the published score is Swfte’s own, which the publisher chose and discloses.
How often is this guide updated?: It carries a last-verified date (6 October 2026) and every provider lists its sources with the date each page was read. Certification and regulatory status changes quickly, so check the primary source before you sign.

How we rank

What “sovereign cloud” means, and what it does not

Comparison table

What each provider publishes

Swfte Sovereign Deployment

Swfte Light Cloud

OVHcloud

Scaleway

Outscale (Dassault Systèmes)

IONOS Cloud

STACKIT (Schwarz Digits)

T Cloud Public (formerly Open Telekom Cloud)

AWS European Sovereign Cloud

Aruba Cloud

Exoscale (A1 Digital)

Google Cloud sovereign offerings (incl. S3NS)

Hetzner

Microsoft Sovereign Cloud

Mistral Compute

Nebius

How to choose

Swfte is a platform layer, not a data-centre owner

Sources, last verified 6 October 2026

Common questions

Related reading

Ready to build with Swfte?