For public sector, KRITIS & regulated companies
Sovereign Cloud Consulting: Keep Control of Data, Keys and Providers
Prove to auditors, data protection officers and the board that you, not your provider, are in control. Our vendor-neutral sovereign cloud consulting takes you from the Sovereign Cloud Assessment and provider selection (AWS European Sovereign Cloud, Delos Cloud, STACKIT, IONOS, Azure/GCP with EU controls) to a landing zone that meets BSI C5, NIS2 and GDPR from day one. Recognized with the German Innovation Award for decentralized, risk-eliminating architectures.
Avoid the Frankfurt trap: what sovereign really means in 2026
You are sovereign only when your organization can answer three questions with “we” at any time: Who can access the data? Who holds the cryptographic keys? Who decides when and where you switch? Data residency in Frankfurt is necessary, but not sufficient: on its own it leaves the US CLOUD Act, operations staff outside the EU and proprietary services without an exit path unresolved.
You now have real sovereign choices: the AWS European Sovereign Cloud has been in production in Brandenburg since January 2026 and is operated by an EU company with EU staff. Delos Cloud brings the Microsoft stack under German operational control for the public sector. STACKIT and IONOS offer European-controlled platforms, while the Deutsche Verwaltungscloud (DVC) has become a product of the IT Planning Council. At the same time, the BSI has renewed its criteria catalogue with C5:2026. So your question is no longer “whether”, but “which level of sovereignty for which workload, and at what price”.
You get that decision structured: vendor-neutral, by architects who have built the platforms themselves, with a result you can defend in procurement, audit and before the board.
Built for organizations that must prove sovereignty, not claim it
Public administration
Move to the cloud in line with DVC, BSI C5 and procurement law, without depending on a single hyperscaler. For federal, state and local government and public IT service providers.
KRITIS & regulated companies
Use the cloud and still deliver the evidence you owe under NIS2, the KRITIS umbrella act (KRITIS-Dachgesetz), DORA or sector-specific supervision. For energy, healthcare, finance, water and transport.
CIO, CISO & enterprise architecture
Get a sovereignty strategy that holds up: not a slide, but architecture, contracts, key custody and an exit plan you can act on.
Sound familiar? Five situations we help you resolve
- “We use Azure or AWS in Frankfurt and believe that makes us sovereign — the data protection officer and the auditor see it differently.”
- “The tender requires a C5 attestation, DVC conformity and EU operational control. Which provider really meets that, and what does the difference cost?”
- “Our keys are held by the provider. In the event of termination, sanctions or government access, we would have no leverage.”
- “We want to evaluate Delos Cloud, STACKIT or the AWS European Sovereign Cloud, but we have no basis for comparing feature parity, lock-in and migration effort.”
- “We have an exit strategy on paper. Nobody has ever tested it.”
What you get: from first assessment to tested exit
1. Sovereign Cloud Assessment (2–4 weeks): facts for your board
Know how sovereign each workload really is and where you fall short. We classify your workloads by protection needs and sovereignty requirements (data residency, operational sovereignty, technical and legal immunity) and assess your current state against BSI C5:2026, NIS2, GDPR/Schrems II and the criteria of the EU Cloud Sovereignty Framework and the Bitkom criteria catalogue.
You get: Sovereignty scorecard per workload, risk register, prioritized action list, decision paper for management or board.
2. Provider selection & target architecture without overpaying
Choose your provider on facts, not marketing claims: we compare the AWS European Sovereign Cloud, Delos Cloud, STACKIT, IONOS, T-Systems/Open Telekom Cloud as well as Azure and Google Cloud with EU controls by feature parity, operational control, key model (BYOK/HYOK/External Key Manager), attestations, cost model and exit capability.
You get: Decision matrix, target architecture (single, hybrid or multi-cloud), requirements catalogue for procurement/EVB-IT and contract negotiation.
3. Sovereign landing zone & migration with provable controls
Show auditors your C5 and NIS2 controls at any time and reproduce them on demand: we build the landing zone as infrastructure as code, with identity (Zero Trust, Conditional Access), network (private connectivity, ExpressRoute/Direct Connect), encryption with customer-controlled keys, central logging and policy-as-code. Then we migrate your workloads in waves following the Cloud Adoption Framework.
You get: Production-ready landing zone, migration plan, control evidence for audit and supervision. Details: cloud migration consulting and our Cloud Adoption Framework approach.
4. Key custody & exit readiness: switch on your terms
Keep your leverage over the provider: we design and implement BYOK/HYOK with HSM, key lifecycle processes and emergency access. Plus a tested exit plan covering data export, portability and restart at an alternative provider, rehearsed, not just documented.
You get: Key concept, exit runbook, exercise report. More on this: encryption & key management.
5. Compliance support: audit-ready for C5, NIS2, IT-Grundschutz
Know which controls are yours and prove them: we map the customer-side C5 criteria, NIS2 risk management measures and IT-Grundschutz modules to your cloud architecture and prepare you for audits. See BSI C5 consulting and NIS2 consulting.
Five steps to sovereignty you can prove
- Scoping workshop (1 day): In one day you know what “sovereign” means for you in concrete terms: goals, regulatory framework, workload inventory, stakeholders.
- Assessment (2–4 weeks): See your protection needs, gaps against C5:2026/NIS2/GDPR, provider shortlist and cost model.
- Decision: Target architecture and provider selection, with a decision paper for management, data protection, internal audit and the procurement office.
- Implementation: Landing zone as code, keys in your custody, migration in waves, control evidence.
- Operations & evidence: Stay compliant after go-live with optional managed services: continuous compliance monitoring, exit exercises and an annual reassessment.
No learning curve: platforms and regulations we know
Platforms
AWS European Sovereign Cloud, Delos Cloud, STACKIT, IONOS Cloud, Open Telekom Cloud, Microsoft Azure (incl. Cloud for Sovereignty), Google Cloud (Sovereign Controls), OpenStack/Kubernetes on-prem and hybrid.
Security & keys
HSM, Azure Key Vault Managed HSM, AWS KMS External Key Store, Google Cloud EKM, HashiCorp Vault, Confidential Computing, Zero Trust identity (Entra ID, Keycloak).
Regulation
BSI C5:2020/C5:2026, IT-Grundschutz, ISO 27001, NIS2 (NIS2UmsuCG, in force since 6 December 2025), KRITIS umbrella act, GDPR/Schrems II, DORA, EU AI Act, German Administration Cloud strategy, EU Cloud Sovereignty Framework.
Why Insight42 lowers the risk of your sovereign cloud
- Vendor-neutral. Your recommendation follows your protection needs, not partner commissions: we sell no cloud capacity.
- Engineers, not slide consultants. What we recommend can be built: the architects who write your assessment then build the landing zone, as code, with evidence.
- Regulation from practice. Fewer surprises in procurement and audit: experience with BSI C5 and IT-Grundschutz in public-sector projects, with GDPR and EU data residency as architecture principles.
- German company, based in Ingolstadt. German contract basis, German- and English-speaking contacts, European standards.
Your sovereign cloud questions, answered
Is a data center in Germany enough for digital sovereignty?
No. Data residency does not protect against access by the operator or by third-country law such as the US CLOUD Act. Sovereignty only arises from the combination of residency, customer-controlled keys, EU operational control and real exit capability.
AWS European Sovereign Cloud, Delos Cloud or STACKIT — which is “the most sovereign”?
That depends on the workload. The offerings differ in operating model, range of services, key model and price. We evaluate them in a decision matrix against your specific requirements instead of making blanket judgments.
Do we as a cloud customer need our own C5 attestation?
Usually not — the attestation concerns the provider. However, you must fulfil and be able to prove the corresponding customer-side criteria. This is exactly where our BSI C5 consulting helps.
How long does a Sovereign Cloud Assessment take?
Two to four weeks, depending on the number of workloads. You receive a scorecard, a risk register and a decision paper — with no obligation to implement with us.
Go deeper before you decide
How sovereign is your cloud really?
In a 30-minute initial call you get clarity on your protection needs and regulatory framework, and on whether a Sovereign Cloud Assessment pays off for you.
Why Insight42
- Pass audits with less effort: architectures aligned with BSI C5, NIS2 and GDPR from day one, for enterprises and public-sector organizations in Germany and Europe.
- One accountable team: assessment, architecture, implementation and operations from one source. No hand-offs, no finger-pointing, less coordination for you. Founded and led by Martin-Peter Lambert in Ingolstadt.
- Results that run in production: we build and run our own products (Secretary42, Unimatrix-OI, InheritanceVault) and bring the same discipline to your project.
- You stay in control: data residency, key custody (BYOK/HYOK) and a documented exit strategy are built in from day one, not bolted on later.