Everything you need to know about the sovereign Cloud

Laws and regulations regarding data privacy and data location have a significant impact on the use of the public Cloud. Some organizations therefore choose to pull their data back from the public Cloud, but that is not the only solution. With the help of a sovereign Cloud, your organization can comply with local data laws and regulations while continuing to benefit from the convenience and advantages of the public Cloud.

Privacy legislation

The General Data Protection Regulation (GDPR), which came into effect within the European Union in 2018, has led to much stricter handling of privacy-sensitive and personal data. Moreover, this far-reaching regulation has inspired similar legislation in more than a hundred countries. Individuals have the right to have their privacy-sensitive data protected, but also to have it accessible so they can view it and decide whether it needs to be modified or deleted. Data legislation therefore sets requirements for both the protection and the availability of data.

In addition, there is increasing legislation regarding data sovereignty: personal data is subject to the laws of the sovereign state in which the data was produced. In other words, if a Dutch citizen creates data or leaves their information somewhere from within the Netherlands, it is protected by Dutch (and EU) privacy rules. A central aspect of this legislation is the physical location of the data, or data residency: many countries require organizations operating within a specific country to store data about residents on servers located within national borders.

American public Cloud

At the same time, the use of the public Cloud is increasing. This involves moving data and workloads to a data center maintained by a public Cloud provider. For many companies, this is a way to remain flexible and avoid worrying about the costly and complex maintenance of their own server infrastructure or data center. However, by placing data in the public Cloud, it is no longer clear in which geographical location it is stored. Furthermore, the largest and most widely used public Clouds (AWS, Azure, Google) originate from the U.S., and the 2018 U.S. CLOUD Act states that data stored with American Cloud providers remains accessible to U.S. authorities via court order, even if it is located outside the U.S. This conflicts with the requirements set by the GDPR and data sovereignty laws.

More and more organizations, particularly in highly regulated industries, are choosing to stop storing their data in the public Cloud. Some French and Austrian organizations have even stopped using Google Analytics because it could potentially lead to espionage from the U.S. Meta, the parent company of Facebook and Instagram, has even considered halting its operations in the EU due to these legislative contradictions.

Of course, not all data is privacy-sensitive. Information on publicly accessible websites is not, but medical records, customer lists, or address databases certainly are. And for commercial companies, it is wise to properly protect their business data and intellectual property. By classifying data, it becomes clear which data is suitable for the public Cloud and which is not.

‍

What is a sovereign Cloud?

But where do you store that sensitive data? Back to your own private Cloud and handling the costly management yourself? Or do you choose the middle ground: the sovereign Cloud? The term sovereign Cloud describes a framework where data security, processing, and continuity are guaranteed on any Cloud platform. The sovereign Cloud complies with local data storage and data sovereignty laws. In a sovereign Cloud, you retain full control over your data, while it is properly managed and protected by specialists who are well-versed in the ever-changing world of data law and cybersecurity.

‍

Complying with the rules

Legislation regarding data privacy, data sovereignty, and data residency is still evolving and varies from country to country. Complying with the latest regulations requires specialized knowledge that most organizations do not have in-house. Additionally, it is important for an organization to manage data in a way that allows for the rapid application of changing laws. A certified sovereign Cloud provider, such as Fundaments, possesses this expertise and offers the necessary flexibility in data storage and management.

Security, integrity, and accessibility

The Fundaments sovereign Cloud, based on the VMware Sovereign Cloud framework, offers a layered approach to data protection. You comply with local laws and regulations, and your data is securely shielded from unwanted foreign surveillance and other unauthorized entities.

The security, integrity, and availability of data begin with physical data protection—a combination of reliable data backups, proven disaster recovery protocols, secure networks, and robust data center connections. For instance, the local data center of the sovereign Cloud has at least two different locations where data is stored. Furthermore, a strict access policy can be implemented based on the zero-trust principle: all communication between workloads is blocked unless explicitly permitted. External threats can be further excluded using encryption or even an air-gapped network.

Naturally, all these sovereign Cloud facilities are regularly audited and certified according to recognized industry standards. Moreover, the experienced specialists at Fundaments are well-versed in the security strategies and tactics required to protect your applications and data against the threats of ransomware and cyberattacks.

The strict access policy has benefits beyond just security. The operational reliability of the sovereign Cloud and the availability of data ensure smoother business processes. Additionally, it is also perfectly possible to use anonymized personal data for customer analytics to better tailor online campaigns.

‍

Across national borders

Ensuring data is stored securely within the country of origin is essential for regulatory compliance. But what if your organization does business internationally? Increasing regulations regarding cross-border data transfers can impact global trade. The Fundaments Sovereign Cloud separates data from the underlying infrastructure and applications, simplifying data portability and migration. By partnering with Fundaments' specialists, you can be confident that cross-border data transfers remain compliant. It is no coincidence that Fundaments was the first cloud provider to be VMware Sovereign Cloud certified.

Ideally, a sovereign cloud serves as a central component of a multi-cloud strategy that also utilizes public clouds for non-sensitive data. This allows your organization to scale efficiently, control costs, and maintain full data sovereignty. Would you like to know the best solution for your organization? Please contact the specialists at Fundaments.

‍