Cloud Sovereignty for Research and Education

Research data, student records, and institutional workloads require more than "hosted in Europe." The EU Cloud Sovereignty Framework defines eight dimensions that determine whether a cloud provider is truly sovereign, from ownership and legal jurisdiction to supply chain transparency and open-source technology.

VSHN and Exoscale deliver cloud services through the GÉANT OCRE 2024 framework with a sovereignty profile that meets the highest standards defined by the EU.

Why sovereignty matters for research institutions

Most hyperscale cloud providers (AWS, Azure, Google Cloud) are US-headquartered and subject to the CLOUD Act, which allows US authorities to compel disclosure of data stored anywhere in the world, without notifying the data subject or the institution.

For research institutions handling sensitive data (clinical trials, genomics, student records, pre-publication research), this creates legal and ethical risks that "EU region" deployments do not solve. The CLOUD Act applies to the company, not the data center location.

VSHN and Exoscale are both Swiss companies. Swiss law governs all data processing, and neither company is subject to the CLOUD Act or equivalent foreign access laws.

Shortest GDPR compliance path

Switzerland holds an EU adequacy decision, which means transfers of personal data to Switzerland are treated like intra-EU transfers under GDPR. For institutions using Exoscale's Swiss or EU data centers, this eliminates the requirement for Standard Contractual Clauses (SCCs) or a Transfer Impact Assessment (TIA).

By contrast, institutions using AWS, Azure, or Google Cloud must complete a full TIA and implement SCCs because these providers are US-headquartered and subject to FISA Section 702. The GÉANT GDPR Transfer Guide for NRENs explicitly calls out this distinction: for EU/EEA-operated platforms from non-US companies, the compliance checklist reduces to verifying encryption in transit and at rest.

VSHN sovereignty self-assessment

We applied the EU's Cloud Sovereignty Framework (v1.2.1, October 2025) to our own services. This framework was used to score providers in the EU's EUR 180M sovereign cloud tender in April 2026. Three pure-European providers achieved SEAL-3, while a consortium involving Google Cloud scored only SEAL-2.

This is a self-assessment, not a formal SEAL certification. We publish it for transparency so institutions can evaluate our sovereignty profile using the same structured criteria the EU uses.

Overall: SEAL-3 equivalent, the same level achieved by the winners of the EU's own sovereignty tender. No provider worldwide achieved SEAL-4: it requires fully EU/EEA-sourced hardware supply chains and open-source foundations, structural gaps shared by every cloud provider.

Exoscale: European cloud infrastructure

Exoscale is Swiss-headquartered (part of A1 Telekom Austria Group) and operates data centers in seven European cities across Equinix and A1 Group facilities:

90% of Exoscale's electricity comes from renewable sources across all zones. Both Equinix and A1 Group target carbon neutrality by 2030. Sustainability carries 10% weight (AC8) in the GÉANT evaluation scoring, where Exoscale's renewable energy profile scored competitively. See Exoscale sustainability for details and green energy certificates.

Key sovereignty features:

• Guaranteed data location: you choose which data center zone your workloads run in
• No US parent company: A1 Telekom Austria Group is European-owned
• ISO 27001, ISO 27018, BSI C5, and SOC 2 certified, ISAE 3402 audit reports available
• GDPR-compliant DPA provided free of charge
• Free traffic to GÉANT and connected NRENs, no egress charges for academic networking

Sovereignty compared: hyperscalers vs. VSHN + Exoscale

Request a sovereignty assessment

Concerned about data sovereignty for your research workloads? We can assess your current cloud setup against the EU framework and propose a migration path to sovereign European infrastructure.

Request a trial voucher or book a call.