In recent years, the question of where data is stored has become increasingly important. Social and geopolitical shifts have turned this issue from a theoretical debate into a strategic priority. More and more organisations are realising that ‘cloud’ does not automatically mean retaining control. A sovereign cloud offers a dependable foundation to build on.
Geopolitical tensions are prompting companies to reconsider who truly has control over their data. When using cloud solutions, the origin of the provider—European, American, or Chinese—plays a significant role. It’s not just about where the data is stored, but also about the laws that apply. For example, the US Cloud Act can grant the American government access to data managed by a US‑based company, even if that data is hosted in a European data center.
European regulations such as GDPR (privacy) and NIS2 (cybersecurity) do not explicitly require data to remain within the EU, but they do obligate organizations to protect it against unauthorized access, including from foreign governments. Regulators therefore expect organizations to demonstrate where their data resides, who manages the infrastructure, and which jurisdictions apply.
NIS2 also raises the bar around vendor dependency: organizations must assess risks across their entire supply chain. In practice, this often leads to choosing European, locally managed cloud solutions—especially for critical workloads.
At Cheops, we’ve seen these questions rise sharply in recent years, particularly among organizations subject to NIS2 or strict compliance requirements. In reality, many struggle with very concrete concerns: "Who has access to my data today? How easily can I move my data if I switch providers? And how do I prove all this during an audit or regulatory review?"
What is a sovereign cloud?
A sovereign cloud provides a clear answer to the growing concerns around data locality. For Belgian organisations, Cheops applies four fundamental principles that define what a sovereign cloud should be:
- 1. Data stored in Belgium
All data resides exclusively in Belgian data centers. This includes primary data, backups, and all logging and monitoring information. Data traffic is routed solely through European networks.
- 2. Infrastructure and management under Belgian control
All technology (server capacity, storage, network, and security) is managed by a Belgian company. Access rights to data and services remain fully in Belgian hands.
- 3. Fully European from a legal standpoint
There is no legal dependency on non‑European parent companies or governments. This excludes the public cloud services of major hyperscalers, as they remain subject to foreign legislation, even when their data centers are located in Europe.
- 4. Operational autonomy
Service delivery must remain guaranteed, even in the event of international sanctions or policy changes by foreign governments. A sovereign cloud must be able to operate independently during geopolitical tensions, without relying on a foreign provider as a single point of failure.”
Does every organization need to move to a sovereign cloud?
Not every organization benefits equally from a sovereign cloud. The solution becomes particularly relevant in four situations:
- 1. Critical or sensitive data
Hospitals, healthcare providers, financial institutions and public-sector organisations typically handle highly sensitive or mission‑critical data. For them, maximum protection against unauthorised access is essential, including access by foreign governments.
- 2. Strict regulatory requirements
Organisations operating under heavy compliance obligations risk not only substantial fines but also severe reputational damage if they fail to comply. They must be able to demonstrate where their data is stored, who has access to the infrastructure, and how unauthorised access is prevented. Regulators are increasingly focusing on the actual level of control an organisation has, rather than relying solely on contractual assurances.
- 3. High continuity demands
Companies that depend on their IT environment 24/7—such as manufacturers, logistics providers and utilities cannot afford downtime. They want to avoid the risk that a foreign cloud provider might restrict access or enforce sanctions under political pressure, with direct impact on their operations.
- 4. Emotional or ethical considerations
Even organisations that are not required to adopt a sovereign cloud for regulatory or operational reasons may still choose to do so. Emotional or ethical considerations can play a role—for example, choosing not to rely on American providers because current U.S. government policies conflict with their values.
In other cases, a hybrid cloud remains the best approach. This is why many organisations opt for a model where critical and regulated workloads run in a sovereign cloud, while less sensitive applications continue to operate in the public cloud.
The Cheops Sovereign Cloud
Cheops does not build its sovereign cloud on public hyperscalers, but on its own infrastructure across two fully redundant Tier 3+ data centers in Belgium. Tier 3+ is the highest level of reliability available in Belgium. The network, security and operational management are entirely controlled by Cheops.
Our sovereign cloud does not rely on foreign cloud providers or external management platforms. As a Belgian company, we operate under Belgian law and comply fully with European regulations. There is no single point of failure linked to external providers or foreign governments, ensuring that we can guarantee continuity at all times.
With more than 20 years of experience in cloud infrastructure, we have built our own cloud platform based on proven best practices. We take full end‑to‑end responsibility, from design to ongoing management. Our platform lets customers benefit from economies of scale while offering predictable costs and the advantage of local, close‑to‑home support.