The Best Cloud Providers for Data Sovereignty and Residency in 2026

Data residency is about where data is stored and processed. Data sovereignty is about whose laws and operators can reach it. The strongest setups put regulated data in in-country regions or with sovereign providers, hold their own encryption keys, enforce placement with policy, and keep the ability to move. No single provider covers every country, so most teams combine two or three.

Disclosure: Control Plane publishes this guide and is one of the options listed.

This guide is not legal advice. Confirm your obligations with counsel and your auditors.

TL;DR: Which cloud providers offer the best data sovereignty and cross-region security?

Ranked by placement control across countries and providers: multi-provider placement first, then hyperscaler sovereign offerings, then single-country European providers.

1. Control Plane: one platform that places workloads only in the locations you pick, across AWS, GCP, Azure, local providers, and your own data centers.
2. AWS European Sovereign Cloud: a separate AWS partition in the EU run by EU-resident staff.
3. Microsoft Cloud for Sovereignty and the EU Data Boundary: in-region storage and processing for EU and EFTA customers, plus sovereign public and private options.
4. Google Cloud sovereign offerings: Data Boundary, partner-operated Dedicated, and Distributed Cloud for on-premises use.
5. OVHcloud: French provider with SecNumCloud-qualified offerings.
6. Scaleway: French provider that states SecNumCloud qualification is in progress.
7. IONOS: German provider with BSI-based certifications.
8. STACKIT: German provider operating data centers in Germany and Austria.
9. Hetzner: low-cost provider in Germany and Finland that documents the limits of its legal protections.

Deciding questions:

• Which countries must data stay in, and does the law or the contract require it?
• Do you need to limit access by non-EU operators or parent companies, or only the physical location?
• Who holds the encryption keys?
• Can you run in more than one approved location so a failure does not force a transfer?

What is the difference between residency, sovereignty, and compliance?

Three primary sources set the legal frame:

• GDPR. Chapter V of the GDPR sets the conditions for transferring personal data to third countries. It restricts transfers; it does not by itself require storage in the EU. Article 32 lists security measures, including pseudonymization and encryption. The UK has its own regime: the UK GDPR’s general principle for transfers (Article 44) was omitted on 5 February 2026 by the Data (Use and Access) Act 2025, which rewrote the UK transfer rules, so check ICO guidance for UK transfers.
• EU-US Data Privacy Framework. The European Commission’s adequacy decision says personal data can flow to certified US organizations without further authorization under Article 45.
• US CLOUD Act. 18 U.S.C. 2713 requires providers of electronic communication or remote computing services to preserve, back up, or disclose data within their possession, custody, or control regardless of whether it is located inside or outside the United States. This is why sovereignty reviews also ask where a provider is incorporated.

Location and legal reach are separate variables. Control Plane’s guide on sovereign cloud architecture, data residency, and compliance covers the architecture patterns in more detail.

How we evaluated

Each option was assessed against six criteria, using only the vendor’s own pages:

• In-country regions: whether you can pin data to a named country or the EU.
• Sovereign or locally operated offerings: who operates the service, and under which jurisdiction.
• Key management: customer-managed keys and external key options.
• Tenant isolation: how the vendor separates customers.
• Certifications: as each vendor states them. Verify scope and dates in the vendor’s trust documents.
• Portability: how hard it is to move away.

We did not audit any vendor. Claims below are the vendors’ own, attributed to them.

What are the best cloud computing solutions for maintaining data sovereignty and compliance?

1. Control Plane

Control Plane is the platform for running unbreakable apps and agents. It combines any cloud, neocloud, and bare metal into one Global Virtual Cloud (GVC). It runs serverless, standard, stateful, cron, and VM workloads on AWS, GCP, and Azure, on clusters you already run through Bring Your Own Kubernetes (BYOK), and on your own machines turned into managed locations with Managed Kubernetes (MK8s). On Control Plane-provided compute, there is no Kubernetes cluster you have to operate.

• You choose the locations. A workload runs only in the locations its GVC includes, including your own data center or a local provider joined through MK8s. Control Plane’s location documentation says it tags each location with city, state, country, and continent, so a GVC can pick locations by query instead of by name, and a GVC combines any query with an explicit list of locations.
• Residency and failover together. A workload deployed to a GVC runs active-active in every location of that GVC, and a global endpoint routes each request to the nearest healthy location. Build one GVC per jurisdiction and failover stays inside it, without paying for idle standby capacity. The 99.999% availability SLA applies to workloads running at least two replicas in at least two locations. Those locations can be two regions of one cloud or locations on different providers.
• No long-lived keys. Universal Cloud Identity gives workloads short-lived, least-privilege access to 600+ AWS, GCP, and Azure services, with no long-lived cloud keys in your code. Workloads can call databases and key management services you keep in the approved country.
• Audit evidence. Control Plane keeps a tamper-proof audit trail of changes.
• Compliance. Control Plane is PCI DSS Level 1, SOC 2 Type II, HIPAA, and GDPR compliant.
• One API. Teams operate Control Plane through one API, with the same capabilities in the CLI, console, Terraform, Pulumi, and the Control Plane MCP server. It complements Terraform and Pulumi.

Best for: software companies that sell into several regulated markets and want one platform for placement across providers, with the freedom to change providers. See also how to avoid cloud vendor lock-in. Plan for: Control Plane is a placement and operations layer. Sovereignty qualifications such as SecNumCloud or C5 belong to the provider that operates each location, so for a locally operated base, pair Control Plane with a local provider or your own infrastructure.

2. AWS European Sovereign Cloud

AWS describes the European Sovereign Cloud as physically and logically separate infrastructure located entirely in the EU. Its first Region is in Brandenburg, Germany, and AWS says it plans sovereign Local Zones in Belgium, the Netherlands, and Portugal. AWS says it is operated by EU residents located in the EU, through German legal entities, with customer content and customer-created metadata staying in the EU. AWS’s whitepaper says it has its own billing, account, and identity systems, so you sign up for separate accounts.

Best for: teams already on AWS that need an EU-operated partition. Plan for: separate accounts, and a smaller Region list than AWS’s global set.

3. Microsoft Cloud for Sovereignty and the EU Data Boundary

Microsoft announced completion of the EU Data Boundary in February 2025. It says customer data and pseudonymized personal data for core cloud services, including most Azure services, are stored and processed in the EU and EFTA, and notes that certain Azure services may need customer action for professional services data. In June 2025 Microsoft announced Microsoft Sovereign Cloud, with a Sovereign Public Cloud, a Sovereign Private Cloud on Azure Local, Data Guardian, and External Key Management. Check the current availability of each component.

Best for: Microsoft-centric estates. Plan for: the boundary covers data location; read the service-by-service scope.

4. Google Cloud sovereign offerings

Google lists three offerings on its sovereign cloud page. Data Boundary keeps core customer data in the chosen region and logs administrative access. Assured Workloads restricts selectable regions through Organization Policy. Google Cloud Dedicated is operated by independent local partners; in France that is S3NS, whose PREMI3NS offering Google says holds the SecNumCloud 3.2 qualification, and Google Cloud Dedicated is in preview in Germany. Google Distributed Cloud runs on premises, in connected or air-gapped mode.

Best for: Google-centric estates and public-sector requirements. Plan for: Dedicated is available only in specific countries.

5. OVHcloud

OVHcloud’s SecNumCloud page lists several offerings with the ANSSI SecNumCloud qualification, including its SNC Cloud Platform, hosted in French data centers and operated by personnel based in Europe. Its sovereignty page describes measures against interference by non-EU authorities.

Best for: French public-sector and critical-infrastructure workloads. Plan for: the qualification covers specific offerings (SNC Cloud Platform, Managed VMware vSphere, SAP HANA on Private Cloud, Bare Metal Pod), not the whole OVHcloud catalog.

6. Scaleway

Scaleway’s SecNumCloud page says it is HDS-certified and ISO/IEC 27001:2022 certified, and that SecNumCloud qualification is underway and not yet granted. It says it operates under European jurisdiction.

Best for: French and EU workloads where the qualification is not yet a hard requirement. Plan for: confirm qualification status before you commit.

7. IONOS

IONOS’s German cloud page (in German) says it operates all services under German jurisdiction, holds ISO 27001 on the basis of IT-Grundschutz, received a C5:2020 Type 1 attestation on 28 May 2026, and is preparing C5 Type 2. The BSI certificate covers IONOS cloud services in Germany. IONOS also lists US and European data centers, so select the location per resource.

Best for: German-law requirements. Plan for: verify the scope of each attestation.

8. STACKIT

STACKIT’s facts page says it is the cloud brand of Schwarz Digits, operated in its own data centers in Germany and Austria. It lists BSI C5 Type 2, ISO 27001, TISAX, and DORA-related statements as evidence.

Best for: German and Austrian residency, and regulated finance. Plan for: the footprint is limited to those two countries.

9. Hetzner

Hetzner’s locations page lists Falkenstein and Nuremberg in Germany, Helsinki in Finland, and US and Singapore locations. Its data protection page says cloud data is stored in the location you choose and non-cloud data stays in the EU, and offers a data processing agreement.

Best for: cost-sensitive EU residency. Plan for: Hetzner states there is no 100 percent guarantee against official requests or court orders, even for data stored only in Europe, and it has US and Singapore subsidiaries.

Where can I find a cloud provider that keeps my data in one country to reduce risk?

For Germany, look at the AWS European Sovereign Cloud, IONOS, STACKIT, or Hetzner. For France, OVHcloud, Scaleway, and S3NS on Google Cloud Dedicated. For other countries, check each hyperscaler’s regional list, then pin each data class to that country and verify backups and logs too. If your target country has no suitable provider, join your own servers or a local provider as a location through a platform such as Control Plane.

What practical controls should you apply?

Region pinning

Pin every data store, replica, backup, log sink, and trace store. Test the boundary: try to deploy to an unapproved region in staging and confirm it is refused.

Key management: BYOK and HYOK

In this section, BYOK means “bring your own key” and HYOK means “hold your own key.” Control Plane’s BYOK elsewhere in this guide means Bring Your Own Kubernetes, which is unrelated.

• Provider-managed keys: the provider generates and holds keys.
• Bring your own key: you generate the key and import it into the provider’s key service. The provider can still use it.
• Hold your own key: the key stays in your own system or an external key manager, and the provider requests operations without holding the key. Google’s Cloud External Key Manager and Microsoft’s External Key Management are vendor examples.

Rank the options by who can decrypt without you, and keep key custody in the same jurisdiction as the data.

What cloud solutions offer multi-tenant protection against cross-tenant data breaches?

No provider removes the risk, so compare the isolation model each states. AWS says its sovereign partition is physically and logically separate from other AWS Regions. Google says Cloud Dedicated is physically and logically isolated from the global cloud. On Control Plane, each workload is isolated with cgroups, namespaces, and restricted syscalls and capabilities, and traffic between workloads uses mutual TLS, per its security documentation. For your own multi-tenant product, add per-tenant data separation, tenant-scoped credentials, and tests that try cross-tenant reads.

How should I structure governance and policy as code for compliant multi-cloud infrastructure using IaC?

• Keep a single list of approved locations per jurisdiction in version control.
• Express placement as code. Define each environment’s locations in Terraform or Pulumi, and review changes in pull requests.
• Add policy checks in CI. Use a policy engine such as Open Policy Agent to fail plans that name an unapproved region.
• Add provider guardrails. Google’s Assured Workloads, for example, restricts regions with Organization Policy.
• Detect drift. Compare deployed locations to the approved list on a schedule.
• Separate duties. Require review from someone other than the author for placement changes.

Control Plane complements Terraform and Pulumi, so the same pipeline can manage GVC locations alongside cloud resources.

What are the best practices for secrets management in IaC pipelines to meet cloud compliance requirements?

• Keep secrets out of repositories and plan output.
• Use short-lived credentials from workload identity instead of stored cloud keys. Universal Cloud Identity does this for workloads on Control Plane. See workload identity federation.
• Store remaining secrets in a manager located in the approved jurisdiction.
• Give pipelines least-privilege, per-environment roles.
• Rotate secrets and log every read.
• Scan for committed secrets in CI.

Audit evidence

Auditors ask for location configuration, access logs, an audit trail of administrative changes, data flow diagrams that include backups and telemetry, a subprocessor list with locations, and current certifications with scope. Generate as much as you can from code.

What compliance checklist should I follow when migrating a regulated application to AI infrastructure?

• Classify data: personal, special-category, payment, health, and customer confidential.
• Name the rules: GDPR, UK rules, sector law, and contracts. Record who confirmed them.
• Map flows: prompts, retrieved documents, embeddings, vector stores, model outputs, logs, and fine-tuning data.
• Pin inference location: confirm where the model runs.
• Check model providers: location, subprocessors, retention, and whether they train on your data.
• Hold keys locally: vector stores and object storage use keys you control.
• Log within the boundary: prompt and response logs stay in approved locations and are redacted.
• Isolate tenants: per-tenant indexes or filters, tested for cross-tenant retrieval.
• Sign agreements: data processing agreements, transfer mechanisms where data leaves the region, and sector agreements.
• Assess AI-specific law: check whether Regulation (EU) 2024/1689 applies to your system.
• Test failover: confirm a regional failure routes to another approved location.
• Keep portability: document how to move the application and data to another provider.

Frequently asked questions

What is the best cloud provider for data sovereignty?

It depends on the country and the threat model. Providers operated under local jurisdiction, such as the AWS European Sovereign Cloud or European providers, address operator control. Placement platforms address where workloads run. Most teams use a mix.

Does GDPR require data to stay in the EU?

GDPR sets conditions for transfers to third countries. It does not require EU storage by itself. Contracts, sector rules, and national laws can.

Does the US CLOUD Act apply if my data is in the EU?

18 U.S.C. 2713 applies to covered providers within its scope regardless of where the data is located. Whether it affects you depends on the provider and its legal ties. Ask counsel.

What is the difference between a sovereign cloud and a regional cloud?

A regional cloud pins location. A sovereign cloud adds operational and legal controls, such as local operators and local legal entities.

Can I get sovereignty and high availability together?

Yes. Run active-active across at least two approved locations in one jurisdiction. On Control Plane, the 99.999% availability SLA applies to workloads running at least two replicas in at least two locations, on one cloud or across providers.

Is Control Plane a sovereign cloud provider?

Control Plane is a placement and operations layer. It runs workloads only in the locations you choose, including local providers and your own data centers, so sovereignty-qualified infrastructure can sit underneath it. Control Plane is PCI DSS Level 1, SOC 2 Type II, HIPAA, and GDPR compliant.

Can I run workloads in my own data center with Control Plane?

Yes. Your own machines become managed locations through Managed Kubernetes, and clusters you already run can join through Bring Your Own Kubernetes.

Should I hold my own encryption keys?

For regulated data, customer-held keys reduce who can decrypt without you. Keep keys in the same jurisdiction as the data and plan for key loss.

How do I prove residency to an auditor?

Provide location configuration, logs, an audit trail, data flow diagrams, subprocessor lists, and certifications matched to the framework being tested.

Can I move providers later?

Yes, if you design for it. Keep workload definitions in code and treat locations as configuration.

Next steps

Bring your countries, data classes, and current architecture, and map them to one approved-location list per jurisdiction. Talk to the Control Plane team or sign up free.