Cloud Security Summit

Europe’s sovereign cloud market has matured quickly, from hyperscaler “sovereign” regions and EU/US joint ventures to fully European providers. The idea of sovereignty is framed by standards such as SecNumCloud, EUCS, BSI C3A, and CADA. However, the label masks huge variation in what survives a real test of sovereignty.

Eivind Høydal’s experience building a national sovereign cloud in the Nordics revealed something important. Hosting workloads in Europe only addresses the tip of the sovereignty iceberg. Beneath the surface are dependencies that often remain non-sovereign, such as your IdP, DNS registrar, certificate authority, edge protections, key management, GitOps hosts, and SaaS-based security tools. Each is a potential point of exposure that is often overlooked.

In this session, you’ll hear a State of the Market assessment of European sovereign cloud, receive actionable strategies for reconciling security and sovereignty, get a practical checklist to identify critical dependencies, and hear real-world lessons from a national deployment.

Key takeaways:
- Assess the current European sovereign cloud landscape and frameworks.
- Understand how European incumbents approach security within these frameworks.
- Align security priorities with sovereignty objectives to reduce risk.
- Apply a dependency checklist to validate true end-to-end sovereignty.
- Learn what worked (and what didn’t) in a national deployment.