Reading the EU Cloud Sovereignty Framework
- sovereign-cloud
- architecture
- public-sector
How the European Commission turns cloud sovereignty into eight objectives, five assurance levels and a weighted score.
· 5 min read
Service
Sovereignty & resilience
Keep control of your applications and your data, and keep them running: European providers, open-source building blocks and an architecture that can move when it has to.
At a glance
- Format
- Sovereignty assessment, feasibility study, migration
- Duration
- From a feasibility study to a full migration
- Where
- Remote, on site in Luxembourg and the EU when it matters
- Languages
- English, French
When it helps
Sounds familiar?
- Your data sits with a provider subject to non-EU laws with cross-border reach, such as the US CLOUD Act.
- A tender or a regulator now asks about sovereignty, under NIS2, DORA or the EU Cloud Sovereignty Framework.
- Your applications rely on one provider’s proprietary services, and leaving would mean rewriting them.
- A price or licence change from a single vendor has shown how exposed you are.
What I do
What I take on
Sovereignty assessment
Classify each workload by the level it really needs, using the assurance levels of the EU Cloud Sovereignty Framework, instead of one rule for everything.
Feasibility study
Which European providers fit, which services they offer, and what each workload needs in order to move.
Application portability
Containers, open standards and Infrastructure as Code, so a workload can run on more than one provider.
Open-source building blocks
Proprietary managed services replaced by open-source equivalents that your team can run anywhere.
Data and workload migration
Source code analysis and refactoring, a data migration strategy and a cut-over plan per workload.
Continuity and exit
High availability, recovery, encryption keys under your control, and an exit plan that has been tested.
Ecosystem
European building blocks
No single sovereign product covers every need. I start from these options and choose per workload, based on the level of sovereignty it requires.
European cloud providers
- Clever Cloud PaaS · France
- Scaleway IaaS & PaaS · France
- OVHcloud IaaS & PaaS · France
- Outscale IaaS · France
- IONOS IaaS · Germany
- STACKIT IaaS & PaaS · Germany
- Infomaniak Cloud & SaaS · Switzerland
Open-source building blocks
- Kubernetes Containers
- OpenTofu Infrastructure as Code
- PostgreSQL Database
- Keycloak Identity and access
- Matrix Secure messaging
- Nextcloud Files and collaboration
European Alternatives lists European alternatives to everyday digital services, from email to analytics. A good place to start for the SaaS tools around your applications.
Formats
Ways to work together
Sovereignty assessment
A few weeks
Your workloads classified by the level they need, the main dependencies and risks, and a roadmap.
Feasibility and target architecture
Weeks to months
Provider comparison, target architecture and migration strategy, ready for a decision or a tender.
Migration
Several months
With your teams: refactoring, data and workload migration, high availability and recovery.
- 2023 – now
Enterprise architect · EU Publications Office
Migration of strategic assets to a European sovereign cloud: feasibility study, target architecture, source code analysis and refactoring, governance, data and workload migration, high availability, continuity and recovery.
- 2022 – 2023
Agile coach & architect · LU-CIX Management G.I.E.
Luxchat4Gov, secure messaging for Luxembourg government departments: a fork of the open-source Element client for the Matrix protocol, with CI/CD and releases for web, iOS, Android, Windows and macOS.
Blog
Related writing
Other ways I can help
Contact
Let's build something good together.
Tell me about your context and timeline. I usually reply within one business day.