Choosing The Right Flavour Of Sovereign Cloud

In March 2023, Proximus Group and LuxConnect announced the creation of a joint subsidiary in Luxembourg to offer sovereign cloud services. CEO of Proximus Luxembourg Gérard Hoffmann explains why sovereign cloud is an important enabler for Europe’s digital transition.

Today, public and private organisations have an increased appetite to adopt public cloud solutions. This is because public cloud services are instantly available and provide access to the most recent IT innovations, hence providing a perfect support for accelerating digital transformation within a company. Cloud platforms are virtualised implementations of IT infrastructure, such as networking, servers, storage – a.k.a. Infrastructure as a Service – but also go beyond infrastructure to deliver ready to use applications – a.k.a. Software as a Service – as well as multiple solutions in between like Platform as a Service.   

Only a limited number of technology companies are capable of delivering such ‘hyperscaler clouds’ which provide an exceptional pace of innovation. This limited provider choice increases the risk of vendor lock-in and also poses compliance challenges, as it is sometimes challenging to match the cloud providers’ operating model with regulation and compliance obligations.

The so called ‘sovereign cloud’ solution is geared towards mitigating the above challenge, enabling usage of the most innovative cloud services, operated and supported by trusted providers of choice, thereby improving regulative consistency and giving data control back to the cloud consumer. 

Sovereign cloud – compliance vs innovation

The idea of a Sovereign cloud comes from the conflict between two contradicting needs: the first being data protection and the second being the need to access the most advanced technologies in the field of data analysis, artificial intelligence (AI) or machine Learning (ML), to name only a few.

The sovereign cloud solves this dilemma between innovation capacity and compliance. Above all, but not only for regulated sectors, it is an opportunity to quickly exploit the possibilities offered by the public cloud and an opportunity to implement digitalisation projects. Data sovereignty and the cloud are no longer at odds with each other. 

The sovereign cloud is thus becoming an essential element of multi-cloud environments for users of cloud services. It refers to a cloud platform that is built to follow local laws and regulations. A sovereign cloud protects data from hostile foreign access and ensures that the storage  of data  complies privacy regulations. 

With the current conflicting EU/US regulations (GDPR vs US CLOUD ACT), there is a clear need for EU-based institutions to be able to control access to their data and their localization especially when using public cloud supplied by US vendors. 

In that respect there are several flavours of sovereign cloud available on the market today.

One solution is to use confidential computing, which allows the customer to detain the encryption keys for his data, end-to-end, up to the compute level in the cloud. 

For many customers this solution is sufficient: data is encrypted end to end, but the data is still resident in the public cloud.

A disconnected sovereign cloud

For customers with even more critical data, a fully disconnected cloud may be more of the right choice. In this scenario, there is no connection at all to the public cloud, thus the term disconnected, and the operation of the platform is ensured by a trusted local provider.

At the end of the day, choosing the right flavour of sovereign cloud is guided by a proper data classification analysis to start with.

With a physically disconnected platform, companies can benefit from a set of advanced cloud features on a platform that is operated and managed by regional established and trusted provider companies. This configuration allows for total control over where the data is located and who has access to it. 

A key factor of success for Europe’s digital transition

In summary the availability of sovereign cloud solutions is an important enabler for Europe’s digital transition.  It removes regulatory barriers from using the cloud and offers European businesses the security of an ‘à la carte’ cloud solution, combining the technical requirements of cloud computing with innovation and peace of mind. 

Several projects which leverage third-party technologies, while protecting customers’ data, are already available or in the making from Proximus, offering tailored sovereign cloud solutions to companies and institutions. These projects will enable customers to control, secure and manage the risks linked to their data in a global way, while exploiting the essential know-how of technologies from outside the EU. This represents an interesting value proposition to European companies and institutions located in Luxembourg and beyond.