Check data residency
TinySet compares EU data-residency options by provider. TinyResearch lists what to check before choosing one.
TinySet
Dataset · 50 rowsCloud providers' EU data-residency options, with regions, certifications and sovereign offering
| Cloud provider | Sovereign offering name | EU regions | Certifications |
|---|---|---|---|
| OVHcloud | SecNumCloud | France, Italy, Germany, Poland | SecNumCloud, HDS, PCI DSS, CSA STAR, ENS, CISPE |
| Scaleway | SecNumCloud | France, Netherlands, Poland, Italy | ISO/IEC 27001:2022, HDS |
| AWS | AWS European Sovereign Cloud | Germany (Brandenburg), Belgium, Netherlands, Portugal | ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO 27701:2019, ISO 22301:2019, ISO/IEC 20000-1:2018, ISO 9001:2015, SOC 2 Type 1, C5 Type 1 |
| T-Systems | T Cloud Public | Germany, Netherlands | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, TISAX, C5, DORA |
| IONOS | Germany, France, Spain | ISO 9001, ISO 27001, PCI-DSS, SSAE16/ISAE3402, BSI C5, BSI IT-Grundschutz | |
| STACKIT | Germany, Austria | ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, BSI C5 Type 2, TISAX Level 3 (ATA163-1, SH938N), ISO 20000, ISO 50001 | |
| Open Telekom Cloud | T Cloud Public | Germany, Netherlands | BSI C5:2020 Type II, SOC 1/2/3 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701 |
| SAP | SAP Sovereign Cloud | Germany | ISO/IEC 27001, C5, ISO/IEC 27017, ISO/IEC 27018 |
TinyResearch
ReportWhat should we check before choosing a cloud provider for EU customer data?
Selecting a cloud provider for EU customer data is no longer a purely technical or commercial decision — it has become a multi-layered legal, geopolitical, and operational governance question. Five interlocking regulatory regimes (GDPR, Schrems II/EU-US DPF, NIS2, DORA, and the EU Data Act) each impose distinct requirements on the provider relationship, and the emerging EU Cloud Sovereignty Framework adds a formal scoring dimension for public-sector and sensitive workloads. The central tension every decision-maker must resolve is the gap between data residency (where data physically sits) and data sovereignty (which legal system governs who can compel access to it) — a gap that cannot be closed by geography alone when providers are incorporated in the United States [4][5][21].
