Data sovereignty

1. What does data sovereignty mean? #

Data sovereignty has three dimensions:

Dimension 1: Legal sovereignty #

Your data is subject to the legal framework you choose — not one imposed by a third country. This means: data is stored and processed in a jurisdiction whose data protection laws you know and accept. For European organizations, this means GDPR as the primary legal framework, without conflicts arising from extraterritorial laws such as the US CLOUD Act.

Dimension 2: Technical sovereignty #

You have technical control over your data — independent of any single vendor. This means:

• Access to your data is available at any time, without requiring a third party’s authorization
• Data can be migrated to another system without disproportionate effort
• No single point of failure through a single cloud provider

Dimension 3: Operational sovereignty #

You can independently manage, back up, and recover your data — without dependence on external services or network connectivity. In a crisis (cyberattack, network outage, provider insolvency), your data availability is guaranteed.

Why data sovereignty is relevant now #

2. The regulatory landscape #

GDPR: The foundation #

The General Data Protection Regulation (GDPR) is the regulatory framework that defines data sovereignty for European organizations. The most relevant articles for data storage:

Art. 44 – 49 GDPR — Transfer of personal data to third countries: Personal data may only be transferred to third countries where an adequate level of protection is guaranteed. For the US, the EU-US Data Privacy Framework has applied since 2023 — but its long-term stability is uncertain.

Art. 32 GDPR — Security of processing: The controller must implement technical and organizational measures appropriate to the risk — including encryption, pseudonymization, and the ability to restore the availability of personal data promptly after an incident.

Art. 28 GDPR — Processors: Cloud providers acting as processors must be contractually bound; the controller remains responsible for compliance with all GDPR requirements — even when data is held by an external provider.

US CLOUD Act: The conflict potential #

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 2018) authorizes US authorities to require US companies to produce data — regardless of where that data is physically stored. This affects:

• Amazon Web Services (AWS)
• Microsoft Azure
• Google Cloud Platform (GCP)
• All other US cloud providers and their subsidiaries

The practical consequence: If your backup sits with a US cloud provider — even on a server in Frankfurt — a US authority can demand that data. The provider then faces a conflict between US law (obligation to produce) and EU law (GDPR prohibition on disclosure).

How do data protection authorities assess this risk?

European data protection authorities (particularly the Austrian DSB, the French CNIL, and the Bavarian LDA) have concluded in several decisions that using US cloud services for certain data categories provides an insufficient level of protection — regardless of the Data Privacy Framework.

NIS2 Directive and supply chain security #

The NIS2 Directive (§30 BSIG-new, in force since December 2025) explicitly requires assessment of supply chain security. Cloud providers and backup software vendors are part of this supply chain. For NIS2-affected organizations, the question is: which legal framework governs my backup provider? And what risks does that create?

3. Cloud vs. on-premises: The sovereignty question #

The cloud promises — and their limits #

Cloud storage offers undeniable advantages: scalability, pay-as-you-go models, global availability. But for data sovereignty, specific risks arise:

When cloud makes sense — and when it does not #

Cloud makes sense:

• For non-critical data without personal information
• As supplementary geographic redundancy (Tier 4)
• For short-term scaling spikes
• When the organization operates no data center infrastructure of its own

Cloud is problematic:

• For backup data that must be available offline in a crisis
• For personal data with high protection requirements
• For regulated sectors with strict data location requirements (BAIT, §203 StGB)
• When single-point-of-failure risks must be avoided

The hybrid reality #

In practice, most organizations run a hybrid approach. The sovereignty question then becomes not ​“cloud or on-premises?” but: which data belongs where?

Recommendation for a sovereign hybrid architecture:

• Tier 1 (primary backup): On-premises — fast access, full control
• Tier 2 (air gap): On-premises — physical isolation, no cloud dependency
• Tier 3 (long-term archive): On-premises — audit-proof WORM storage under your own roof
• Tier 4 (geo-redundancy): European cloud OR second on-premises location

The key point: Your most critical data — backups for crisis recovery — must not depend on a network connection, a cloud provider, or a third-country legal framework.

→ Silent Brick System: On-premises air-gap backup

4. Vendor lock-in: The underestimated risk #

What vendor lock-in means #

Vendor lock-in occurs when dependence on a single provider becomes so significant that switching is disproportionately expensive, time-consuming, or technically difficult. For cloud storage and backup, this manifests as:

• Proprietary data formats: Backup data in vendor-specific formats that cannot be easily migrated
• Egress costs: Cloud providers charge high fees for downloading your own data (typically EUR 0.05 – 0.12/GB)
• API dependencies: Applications built on provider-specific APIs
• Contractual binding: Long-term contracts with minimum consumption commitments

The cost of lock-in #

Example calculation: Migrating 100 TB of backup data from a hyperscaler

These costs arise every time you want — or need — to switch providers. And they scale linearly with data volume.

The EU Data Act and data portability #

The EU Data Act (in force since 12 September 2025) partly addresses this problem:

• Cloud providers must facilitate switching to another provider
• Egress fees for provider switching will be phased out
• Minimum interoperability requirements will be defined

But: full implementation takes time, and proprietary data formats remain a practical obstacle.

The sovereign alternative: Open standards, local control #

On-premises storage with open interfaces eliminates lock-in risk:

• Standard protocols: NFS, SMB, iSCSI, FC, S3-compatible — no proprietary formats
• No egress costs: Your data is available locally at any time
• Vendor independence: Backup software and storage hardware can be changed independently
• Calculable costs: No variable cloud fees, no billing surprises

5. Made in Germany: Why origin matters for hardware #

Why hardware origin is a sovereignty question #

Data sovereignty is not only about storage location — it is also about the origin of the technology. Hardware developed and produced in a third country is subject to that country’s legal framework. And that can include backdoors, disclosure obligations, or export restrictions that European users cannot control.

The case for European hardware #

Legal framework: Hardware developed and produced in the EU is subject exclusively to European law. No CLOUD Act, no FISA 702, no extraterritorial disclosure obligation.

Supply chain security: The NIS2 Directive requires assessment of supply chain security. A European manufacturer offers a more transparent supply chain than a global corporation manufacturing across dozens of countries.

Geopolitical independence: In a world of growing geopolitical tensions — export restrictions, sanctions, trade conflicts — European hardware reduces dependencies that can become strategic risks.

Privacy by design: European manufacturers develop products in the context of GDPR and European data protection principles. Data protection is a design principle, not a retroactive add-on.

FAST LTA: Made in Germany #

FAST LTA GmbH develops and manufactures all storage systems in Munich:

• Silent Brick System: Air-gap backup with physical network isolation
• Silent Cubes: Hardware WORM for audit-proof long-term archiving
• Silent AI: On-premises AI storage

All systems: German development, German manufacturing, European legal framework. No CLOUD Act. No third-country risk.

→ About FAST LTA → Products overview

6. Sector-specific requirements #

Financial services: BAIT and DORA #

BAIT (German supervisory requirements for IT in banking): BaFin requires that IT outsourcing by financial institutions (including cloud services) does not result in loss of control. Backup data in a US cloud raises specific questions that must be resolved with the supervisory authority.

DORA (Digital Operational Resilience Act): Since 17 January 2025, financial entities must assess and manage dependencies on ICT third-party providers (including cloud providers). DORA requires stress testing and exit strategies for every critical ICT service provider.

Recommendation: Critical backup data on-premises with air-gap protection. Cloud only for non-critical data or as supplementary redundancy at European providers.

Healthcare: §203 StGB and patient data #

In healthcare, patient data is protected under criminal law through §203 StGB (breach of professional secrecy). Disclosure to third parties — including cloud providers — is only permitted under narrow conditions.

Recommendation: Patient data backups exclusively on-premises. Hardware WORM for long-term archiving of medical documents (§28 RöV for radiation therapy records: 30 years; 10 years for diagnostic X‑rays).

→ Industry solution: Healthcare

Public administration: BSI (German Federal Office for Information Security) requirements #

Public authorities at federal and state level are subject to BSI IT-Grundschutz requirements. For classified information (VS-NfD and above), additional physical security requirements apply that preclude cloud storage in many cases.

Recommendation: On-premises storage with BSI-compliant backup architecture. Air-gap layer for critical infrastructure (KRITIS) systems.

→ Industry solution: Public administration

Industry and critical infrastructure: Production data and OT security #

In manufacturing and for critical infrastructure operators, data sovereignty covers not only personal data but also production data, formulations, control configurations, and OT (Operational Technology) systems. This data is business-critical and must neither be lost nor fall into the wrong hands.

Recommendation: Strict separation of OT and IT backup. Air-gap protection for production data backups. Sovereign storage without cloud dependency.

→ Industry solution: Manufacturing

7. Sovereign data architecture: Reference model #

The four principles of sovereign data storage #

Principle 1: Legal clarity All storage systems are subject exclusively to European law. No third-country conflicts, no CLOUD Act risk.

Principle 2: Physical control Critical data is stored on your own hardware, physically located in your own data center. No loss of control through third-party providers.

Principle 3: Open standards Standard protocols and open interfaces prevent vendor lock-in. Data is portable at any time.

Principle 4: Self-sufficient recoverability In a crisis — network outage, cloud outage, provider insolvency — all critical data can be independently recovered, without dependence on external services.

Reference architecture: Sovereign backup and archive #

┌────────────────────────────────────────────────────────┐
│                    YOUR OWN DATA CENTER                 │
│                                                        │
│  Tier 1: Primary backup (Silent Brick)                 │
│  ├── Fast recovery (RTO < 1h)                          │
│  ├── Standard protocols: NFS, SMB, iSCSI, S3           │
│  └── Fully under your own control                      │
│                                                        │
│  Tier 2: Air gap layer (Silent Brick Max Air)          │
│  ├── Physical network isolation after backup           │
│  ├── Ransomware-resistant recovery                     │
│  └── Hardware Made in Germany                          │
│                                                        │
│  Tier 3: WORM archive (Silent Cubes)                   │
│  ├── Hardware WORM: physically immutable               │
│  ├── Audit-proof long-term archiving                   │
│  └── 10+ year retention, compliance-compliant          │
│                                                        │
└────────────────────────────────────────────────────────┘
              │ (optional, geo-redundancy only)
              ▼
┌────────────────────────────────────────────────────────┐
│  Tier 4: Geo-redundancy                                │
│  ├── Option A: Second own location                     │
│  └── Option B: European cloud provider (supplementary) │
└────────────────────────────────────────────────────────┘

Result: An architecture that is fully sovereign — under your own roof, under your own legal framework, with your own recovery capability.

→ Products overview

8. Recommendations for action #

Immediate: Quick wins for greater sovereignty #

1. Create a data inventory: Where does which data sit? Which legal framework governs the storage systems?
2. Assess CLOUD Act exposure: Are you using US cloud providers for personal or business-critical data? If so: assess and document the risk.
3. Calculate egress costs: What would it cost to download your cloud data? That is the price of your dependency.
4. Check backup location: Is your backup data available without a network connection in a crisis?

Medium-term: Adjust the architecture #

1. Bring critical data on-premises: Migrate backup and archive data with high protection requirements to your own sovereign hardware.
2. Introduce an air-gap layer: Physically isolated backup for ransomware resilience and operational sovereignty.
3. Implement WORM archiving: Audit-proof long-term archiving on hardware WORM — without cloud dependency.
4. Reduce vendor lock-in: Switch to standard protocols and open interfaces.

Long-term: Sovereignty as strategy #

1. Supply chain assessment under NIS2: Assess hardware and software vendors on origin, legal framework, and dependencies.
2. Evaluate European alternatives: For new projects, prefer European providers — GAIA‑X compatible, GDPR-native, without third-country risks.