How it works
AWS European Sovereign Cloud
We design, build, and operate sovereign cloud environments on AWS European Sovereign Cloud compliant with EU law, governed by EU residents, and protected from extraterritorial access. Plus a controlled bridge to keep your existing AWS estate working alongside it.
Numbers
Built for Sovereign Cloud Operations
Infrastructure, governance, and funding designed for regulated cloud environments
MAP 2.0 funding eligibility for qualifying migrations
CAGR forecast for Sovereign Cloud to 2027 (IDC)
EU-resident operations, support, and technical services
AWS committed investment in European infrastructure, jobs and skills
your challenges
Why Standard Cloud Regions Fall Short
GDPR, NIS2, and sector regulations have raised the bar. Region selection alone is no longer a defensible control for regulated workloads.
US CLOUD Act exposure
GDPR and NIS2 compliance gaps
No guarantee of EU data residency
Outage and geopolitical fragility
No bridge for your existing AWS estate
what you get
Sovereign by Design for Compliance, Continuity, and Operational Control
Governed by EU law
Workloads run in the Brandenburg, Germany partition under a dedicated German parent company. EU-resident operators only, subject to EU law, with full extraterritorial protection.
Working cross-partition bridge
A controlled, auditable backup and recovery path between AWS ESC and standard AWS partitions. Already running in our sandbox.
Sovereign failover by design
Architecture built to keep operating independently of the commercial AWS partition during a major regional outage. Separate AWS Organizations, IAM stack, and in-region billing.
MAP 2.0 funding, fully managed
Migrations above €500K qualify for AWS MAP 2.0. Below that, MAP Lite applies. We run the procurement, the Customer Sign-off, and the two-tranche credit flow: first tranche (25%) at €50K spend, second tranche (75%) at migration completion, with credits calculated on account revenue rather than resource tagging.
Our Approach
Four pillars of digital sovereignty
Our architecture and operating model address each dimension of sovereign cloud:
Data residency
Where your data lives
-
Geographic storage within EU legal boundaries
-
Cross-border transfer controls at partition level
-
Data classification and handling requirements
-
Jurisdictional control over all access
Operator access
Who can reach your data
-
Zero standing access for AWS or any third party
-
Vault-issued short-lived STS credentials, no static IAM
-
Full audit trail on every access attempt
-
Legal protections against unauthorized access
Resiliency
What keeps you running
-
Operations independent from commercial partition outage
-
Separate AWS Organizations and billing systems
-
Tested failover path validated in our live sandbox
-
Survivability through geopolitical disruption by design
Independence
Who governs the environment
-
Dedicated German parent company, EU leadership
-
EU-only staffing for operations and support
-
Complete compliance documentation chain
-
Full transparency of operations and governance
Collaboration
Built on Tools Your Team Already Knows
WHY IT MATTERS
“As a global bank, our customer data must be kept within our home country’s legal jurisdiction. We need iron-clad guarantees around data residency, access controls, and audit trails to meet our compliance obligations.”
FAQ
Find the most common answers here
AWS European Sovereign Cloud (ESC) is a separate AWS partition physically located in Brandenburg, Germany, operated under a dedicated German parent company. Unlike a standard EU region, ESC is governed exclusively by EU residents subject to EU law, with an independent control plane, a separate IAM stack, and its own billing systems. It is structurally protected from the US CLOUD Act: because the operating entity is not a US company, US authorities cannot compel data disclosure regardless of where the data is stored.
Not with our approach. We build and operate a controlled, auditable cross-partition bridge between your ESC environment and your existing commercial AWS partition. Your regulated workloads run in the sovereign environment while your broader AWS estate continues to function alongside it. The bridge uses Terraform, HashiCorp Vault, and short-lived STS credentials, with no static IAM and a full audit trail on every cross-boundary operation.
No. ESC is designed as a complement to your existing AWS estate, not a forced replacement. The typical starting point is identifying the specific workloads that carry regulatory risk, those subject to GDPR data residency requirements, NIS2 audit obligations, sector-specific rules, or workloads where CLOUD Act exposure is a board-level concern. We scope the migration around those workloads and build the cross-partition bridge to keep everything else running as-is.
Yes, ESC carries a cost premium over standard AWS regions such as eu-central-1 (Frankfurt). Based on early pricing calculator data, the uplift sits at roughly 15% across common services , New AWS ESC Price Calculator: https://pricing.calculator.aws.eu/#/
AWS Migration Acceleration Program (MAP) 2.0 provides credits to offset the "double-bubble" cost of running old infrastructure and AWS simultaneously during a migration. For ESC migrations, the threshold is €500K in migration scope (meaning the expected AWS revenue from migrated workloads, not consulting fees). Above that, full MAP 2.0 applies with a two-tranche credit model. Below €500K, MAP Lite applies. We manage the entire procurement process on your behalf.
It means no one (not AWS, not CBTW, not any system) holds permanent credentials that could be used to access your environment at any time. Instead, our architecture uses HashiCorp Vault to generate short-lived STS credentials on demand, scoped to the exact operation being performed and expiring automatically after use. Every access attempt is logged in a full audit trail. Through AWS Nitro System Hypervisor Architecture not even AWS can have access to company data.
It depends on the scope and complexity of the workloads being moved. A focused migration of one or two regulated workloads can move in weeks. Larger migrations covering multiple teams, data pipelines, and identity systems are typically phased. We start every engagement with a scoping phase to define the migration boundary, assess cross-partition bridge requirements, and produce a phased roadmap before any infrastructure work begins.
The ESC infrastructure is located in Brandenburg, Germany, and is governed by EU law, accessible to organizations across the EU, not only German companies. AWS has committed to also launching new “Sovereign Local Zones” in Belgium, the Netherlands, and Portugal. Early adopters include regulated sectors: EWE AG (energy and telco, 11,000+ employees), Medizinische Universitat Lausitz - Carl Thiem (state medical university, ~1,200 beds), and Sanoma Learning (K12 EdTech, 11 countries, ~25M students). Banking, healthcare, public sector, and critical infrastructure are the primary verticals seeing immediate regulatory pressure.
get in touch
Start your sovereign cloud conversation
Do you want to scope a migration, evaluate ESC for a specific workload, or try to understand your CLOUD Act exposure? We can clarify this with you.
