TL;DR: hosting in Europe is good. But an "EU region" on a US cloud is not sovereignty. The CLOUD Act keeps the door open. Real sovereignty is infrastructure you own, on a European host, described in Terraform and Ansible. Here is the playbook I use. Which open-source components replace which US services. Where your data lives. And how to stay AI-ready without depending on a US provider.
This article is for CTOs and tech leads at European SMBs and scale-ups that handle sensitive data. Fintech, healthcare, public sector.
Sovereignty is no longer a slogan. It is an architecture decision.
In 2026, digital sovereignty moved from slogan to technical constraint. Digital sovereignty means keeping control of your data and your infrastructure. Who can reach it, under which law, and from where.
The European framework kept stacking, text after text. GDPR has protected personal data since 2018. The NIS2 directive tightens cyber obligations, and member states have been transposing it since late 2024. DORA forces financial players to manage their cloud dependency, and it applies since January 2025. The Data Act makes switching cloud providers easier, and it applies since September 2025.
The AI Act deserves an important nuance. It entered into force in August 2024. Its transparency rules do apply in August 2026. But watch out for a calendar trap. In May 2026, the EU agreed to push high-risk system obligations to December 2027. So do not build your stack to beat a single date. Build it because the pressure is structural, not a one-off.
The other driver is resilience. The summer of 2026 was a blunt reminder. AWS had several outages in July. On the 16th, an incident on its CloudFront service lasted more than three hours. On the 24th, an outage in its Oregon region took down Apple Pay, Reddit and others for about 80 minutes. It was the third notable incident in three months.
A hyperscaler is a cloud giant like AWS, Azure or Google Cloud. When everyone depends on the same hyperscalers, everyone falls together. The underlying shift is real, right up to the top. In April 2026, the European Commission awarded a sovereign cloud contract. Up to 180 million euros over six years, for its own institutions.
On my side, I have been building sovereign self-hosted stacks for a while. Two personal projects serve as my base. A turnkey DevSecOps bundle, and a self-hosted zero-trust VPN mesh. Both run on Hetzner, a German host. Both deploy fully from code, never by hand.
An "EU region" on a US cloud is not sovereignty
Here is the most common mistake. You tick "Europe region" at your US cloud, and you feel compliant. The problem is not where the data is stored. The problem is who can demand it.
The CLOUD Act is a US law from 2018. It lets US authorities compel a US company to hand over data. Even when that data sits in Europe. So the European subsidiary of a US group stays under that law. The server location changes nothing.
European courts already flagged this risk. The Schrems II ruling, in 2020, invalidated the data transfer framework to the United States. The reason: possible access by foreign authorities to your data.
Hyperscalers now offer so-called "sovereign" options. Isolated regions, operated in Europe. It is better than nothing. But the parent company stays American, so under American law. Sovereignty is not just a storage location. It is control. Who owns the infrastructure, who holds the keys, who answers subpoenas. The simplest answer to those three questions is to host it yourself, on a European provider.
Replace every US service with a component you control
Good news: for almost every US service, there is an open-source equivalent you host yourself. This is the core of the DevSecOps bundle I deploy for clients, on their own infrastructure. Here is the mapping I use:
- Identity and SSO: Keycloak replaces Okta, Auth0 or Entra ID. SSO, or single sign-on, means one login for all your apps. Keycloak also handles roles and a second factor.
- Zero-trust network: Netbird replaces Tailscale or Zscaler. It is a mesh VPN built on WireGuard. Zero-trust starts from a simple rule: trust no one by default, even inside the network.
- Secrets: Vaultwarden holds team passwords. For application secrets, you add Vault or Infisical. Everything stays with you, never in a third-party vault.
- Monitoring and logs: Grafana, Prometheus and Loki replace Datadog or New Relic. You see your metrics and logs without sending them out.
- Backups: Restic and pgBackRest write to MinIO. MinIO is S3-compatible object storage that you host yourself.
- HTTPS entry and DNS: Traefik handles the reverse proxy and Let's Encrypt certificates. For DNS, a European player like OVH is enough.
Every block is open-source. You can audit it, fork it, run it without a license. And most of all, your data never leaves your perimeter.
Deploy everything with Terraform and Ansible, not by hand
A stack built by hand does not stay sovereign for long. It drifts, and soon nobody can rebuild it. So I describe everything in code. Two tools split the work. Terraform creates the infrastructure: the machine, the network, the firewall, the DNS. Ansible then configures the machine: the packages, the services, the hardening.
My self-hosted VPN project shows it well. Terraform provisions a VM on Hetzner and manages DNS on OVH. Two European providers, one code file:
terraform {
required_providers {
hcloud = { source = "hetznercloud/hcloud", version = "~> 1.45" } # VM on Hetzner (DE)
ovh = { source = "ovh/ovh", version = "~> 0.50" } # DNS on OVH (FR)
}
}
# Then Ansible hardens the host and installs the service:
# roles/system-hardening -> updates, firewall, fail2ban
# roles/netbird-install -> the self-hosted service
Ansible takes over. One role hardens the system. Another installs the service. The whole thing runs through a GitHub Actions pipeline. A plan on every pull request. A deploy on merge. A separate job to tear it all down cleanly.
The real win is reproducibility. You redeploy the same stack elsewhere in one command. If your host raises prices or goes down, you move without starting over. The same code serves me on Hetzner, OVH, GCP or DigitalOcean. That is the opposite of lock-in.
Harden the host and encrypt your backups
Owning the infrastructure also means protecting it. Nobody does it for you. My Ansible hardening role does the bare minimum. Automatic security updates. A firewall closed by default. fail2ban against brute-force attacks. Useless services turned off. fail2ban bans an IP address after too many failed login attempts.
Then, backups. When you own the infrastructure, you also answer when a disk dies. I encrypt backups with Restic. The Postgres database goes out with pgBackRest. Both write to storage you control, not to a third party's S3. And I test the restore for real. A backup you never restored is not a backup.
This point meets a DORA requirement. Financial players must be able to exit a provider, without getting stuck. With code and portable backups, that exit is already prepared. You do not improvise it on outage day.
Stay AI-ready without handing your data to a US provider
Sovereign does not mean cut off from AI. It means keeping control. The trap is sending your raw data to a US API. There, you lose residency and control in one move.
So I treat the model as a spare part. It plugs in behind a gateway, and it swaps out. I keep the model at the end of the chain, never at the center of the system. I wrote a whole article on that. And I mask personal data before it reaches the model, just like when securing an agent.
For sovereignty, you have two paths. A European provider like Mistral. Or an open-weight model you host yourself. An open-weight model has public weights. So you can run it on your own machine. You serve it on a European GPU, at OVHcloud or Scaleway.
Your data plane stays with you. The model becomes an implementation detail, not a dependency. The result: you get AI, but you decide where the data goes.
The cost changed in 2026. Do the real math.
The cloud sold itself on two promises. Simple: no more servers to manage. And cheap: you pay for what you use. In 2026, both have aged.
Simple, less and less. Tracking the bill became its own job, with a name: FinOps. Cheap, not really. Pay-as-you-go punishes workloads that run all the time. Data egress gets billed, and managed services pile up.
So some companies go the other way. It is called repatriation: moving back to your own infrastructure. 37signals brought its cloud bill down from 3.2 to 1.3 million dollars a year. A Flexera study estimates about a fifth of the workloads that moved to the cloud have already come back.
An honest word about money. Self-hosting is not always cheaper. In 2026, even European hosts raised prices. Hetzner increased its rates several times. On 1 April, by up to about 37%. On 15 June, some dedicated-vCPU plans more than doubled. The cause is not margin. The price of DRAM memory jumped by more than 90% in a single quarter.
So do the real math, with real numbers. Three habits help:
- Size it right. Many stacks run on far less than what we provision by reflex.
- Pick the right instance type. Arm plans rose far less than dedicated vCPU.
- Count the total cost, not just the VM. On a hyperscaler, data egress and managed services inflate the bill.
And count what sovereignty gives you in return. No lock-in, simpler compliance, an exit that always stays open. Lock-in is the dependency that makes leaving too expensive. For an SMB with sensitive data, that control is often worth more than a few euros of VM.
The sovereign self-hosting checklist
Before you call yourself "sovereign", tick every box.
- [ ] The host is European, and out of reach of the CLOUD Act
- [ ] You do not confuse "EU region" with real sovereignty
- [ ] Every US service has a self-hosted open-source equivalent: identity, secrets, network, monitoring, backups
- [ ] All the infrastructure is described in Terraform and Ansible, not built by hand
- [ ] The same code can redeploy the stack on another host
- [ ] The host is hardened: auto updates, firewall, fail2ban, useless services off
- [ ] Backups are encrypted, portable, and you already tested a restore
- [ ] The AI model is isolated behind a gateway, and replaceable
- [ ] Personal data is masked before it reaches the model
- [ ] You did the real cost math: sizing, instance type, total cost
- [ ] An exit strategy exists, ready to run, in the spirit of DORA
What to remember
Sovereignty is not a marketing badge. It is a chain of technical decisions. An EU region on a US cloud is not enough. Control comes from infrastructure you truly own.
The good news is that the building blocks exist, all open-source. Terraform and Ansible assemble them into a stack you master. And that stack stays AI-ready, on your terms.
Do you want to build a sovereign stack, or check that yours really is one? That is exactly what I do. Get in touch. Host in Europe. But host on infrastructure that is truly yours.
Sources: AI Act "digital omnibus" (Gibson Dunn) · EU digital sovereignty (FOSS Force) · Self-hosting boom (elest.io) · AWS CloudFront outage, 16 July 2026 · AWS Oregon outage, 24 July 2026 · Hetzner 2026 price increases · Cloud repatriation, 37signals (DCD) · Repatriation trends (HBS) · GDPR · NIS2 · DORA · Data Act · CLOUD Act (2018) · Schrems II (2020).
Top comments (0)