Where does your data run, and who can get in? More and more governments and large organisations are asking that question before they choose a cloud. Read this before you decide.
Who will be able to reach your data?
Your business applications run in the cloud, usually on AWS, Azure or Google Cloud. Convenient and familiar. Those providers are American, though, and for years that was simply taken for granted.
Do you work as a CIO, IT manager or architect at a government body or a large organisation? Then you are now hearing the question from the board, from security and from procurement: can this run with a European provider too?
At its heart lies the American Cloud Act. This law gives US authorities access to data held by American companies, even when that data sits in Europe. A German or Dutch subsidiary falls under this law as well.
Why governments and banks are already choosing
Digital sovereignty is shifting from a preference to a procurement requirement. Recent decisions make that concrete:
- In April 2026 the Dutch central government signed a framework agreement with STACKIT. Public sector organisations still decide for themselves, but the terms are fixed: data within the EEA and audit rights.
- De Nederlandsche Bank moved critical services away from AWS to a European alternative.
- The government blocked the acquisition of a provider of public IT by an American company.
The risks are real. When the US imposed sanctions on the chief prosecutor of the International Criminal Court (ICC) in early 2025, he lost access to his Microsoft account and had his bank accounts frozen. Dependence on a supplier under foreign jurisdiction affects your continuity.
STACKIT in brief
STACKIT is the sovereign cloud of Schwarz Digits, the IT division of the Schwarz Gruppe. That is the parent company of Lidl and Kaufland. The data centres are located exclusively in Germany and Austria.
The platform holds the most demanding certifications: BSI C5 Type 2, ISO 27001, ISO 27017 and ISO 27018. This means it aligns with the requirements of the public sector and regulated sectors.
At LINKIT, we develop business-critical applications for the Schwarz group on STACKIT, nominated by both Mendix and STACKIT as the focus partner for Mendix on STACKIT. We built one of the first applications ever to go live on the platform.
Stay the owner of your own IT
STACKIT offers fewer ready-made services than AWS or Azure, and for a comparable setup the price is higher. You choose STACKIT for certainty and continuity, not for the lowest price.
For sovereignty, you choose the route where you determine the infrastructure yourself, for example STACKIT or your own data centre, rather than the default managed cloud. This gives you more control, and it asks more of your own cloud expertise.
The platform fits well when data location, compliance and sovereignty weigh heavily. Especially when you are setting up something new. Then you build STACKIT in from the start.
Not sure? Start with your goal. Decide which risk you want to cover, and choose on that basis. If sovereignty weighs lightly and your priorities lie elsewhere, a full migration makes little sense right now.
From hyperscaler to STACKIT: how to approach it
We use our 4D model, the same approach as in our development projects:
- Discover: define your goal and map out your applications and integrations.
- Design: design the new environment, with attention to architecture, access and management.
- Develop: migrate in phases. The data migration is the critical moment.
- Drive: manage and optimise after going live.
Is sovereignty a question for you too?
Want to go deeper? Put your situation to our experts. We will think it through with you, from initial exploration to migration and management.
