What is sovereign cloud and what does it really protect?

Sovereign cloud is a class of cloud offerings designed to provide additional guarantees of control: data staying within a defined region, local operations staff, technical and organizational isolation from the rest of the platform, sometimes a separate operating company. In Italy the public-sector reference is the PSN (Polo Strategico Nazionale), whose public price list is updated periodically (as of September 2026 the latest was the August 2026 release); but reducing sovereign cloud to government is a mistake: real demand increasingly comes from the regulated private sector. The typical guarantees cover data residency, access restricted to European personnel and customer-managed encryption keys, but they often skip over the point that matters most: if the operator remains a subsidiary of a group subject to extraterritorial laws like the CLOUD Act, the disclosure obligation follows the group, not the data center where data is physically stored. That is why the choice should be treated as a risk matrix per data class, not as a single label.

See also: CLOUD Act · US law compelling American providers to hand over data under US legal orders, even when it is stored in Europe.

What it really protects (and what it does not)

The typical guarantees cover data residency, access restricted to European personnel, customer-managed encryption keys, operational continuity. What they often do not change is jurisdiction: if the operator remains a subsidiary of a provider subject to extraterritorial laws like the CLOUD Act, the disclosure obligation follows the group, not the data center. The distinction to hold on to is always the same: data residency says where data resides; sovereignty is about who can be compelled to hand it over. Serious offerings are transparent on this point; those that use sovereignty only as a marketing label (so-called sovereignty washing) blur it. The most solid architectures separate the layers: the provider's infrastructure, but keys managed outside its control (HYOK), or an operator legally independent from the technology supplier.

The decision framework for a private company

The choice is not ideological, it is a matrix: you classify your data and assign each class the level of guarantee it needs. For standard workloads, hyperscalers in ordinary configuration remain the most efficient choice. For regulated data (finance, healthcare, NIS2 sectors) you evaluate sovereign regions, external keys or both. For the genuinely strategic core, the options are providers under European jurisdiction or hybrid architectures keeping that part in house. Price the trade-offs honestly: sovereign offerings cost more, lag on new features and reduce elasticity. Moving everything to sovereign cloud "to be safe" is as costly a mistake as ignoring the topic: you buy sovereignty where it is needed, not by the catalog.