What Is Sovereign Cloud? What It Means for Your Enterprise

The cloud may be global, but the laws governing enterprise data are not. As organizations scale AI and customer data is created across countries, they face different rules on where sensitive information can live, who can access it, and which authorities have jurisdiction.

Sovereign cloud gives enterprises greater control over those boundaries. Here’s what it means, what’s driving adoption, how it works, and what IT and security leaders should consider when evaluating providers and Salesforce solutions.

• Sovereign cloud keeps data, operations, and technology under the legal and operational jurisdiction of a specific country or region.
• Laws and regulations such as GDPR, the CLOUD Act, Schrems II, and DORA are making sovereignty an increasingly important consideration in enterprise cloud decisions.
• Salesforce supports sovereign cloud requirements across infrastructure, governance, security, and privacy through Hyperforce, Data 360 Governance, Salesforce Shield, and Privacy Center.

A sovereign cloud is cloud infrastructure designed to keep data, operations, and technology under the legal and operational jurisdiction of a specific country or region. It gives organizations greater control over where regulated data is stored and processed, who can access it, and which laws govern it.

Data residency alone does not guarantee sovereignty. Data may be stored within a country's borders while the provider or its personnel remain subject to laws elsewhere. A sovereign cloud considers the full operating model, including legal authority, infrastructure access, and control over the technology.

As enterprises expand AI, CRM, and other data-intensive workloads globally, these controls can become critical to meeting regional requirements. Salesforce's Hyperforce architecture gives customers greater choice and control over where their Salesforce data resides, helping organizations address data residency and resilience requirements while continuing to operate on the Salesforce Platform.

A public cloud can operate a data center in a particular country without providing the legal and operational controls required for sovereignty. Similarly, a private cloud gives an organization dedicated infrastructure but does not automatically eliminate exposure to foreign laws.

For many enterprises, these models are complementary rather than mutually exclusive. An organization might use sovereign cloud for regulated data and workloads while continuing to use public cloud services where jurisdictional restrictions don't apply. In that sense, sovereign cloud is one way to implement data sovereignty requirements within a cloud environment.

Regulation largely shapes sovereign cloud adoption. As governments tighten controls on how sensitive data is used, enterprises must consider not only where their data resides but which laws may apply to it.

Several major frameworks have influenced this environment:

• GDPR: The EU’s General Data Protection Regulation sets requirements for processing personal data and transferring it outside the European Economic Area, so the safeguards around international data transfers are an important part of cloud decisions.
• CLOUD Act: U.S. law can require U.S.-based service providers to produce data within their possession, custody, or control, even when that data is stored outside the United States.
• Schrems II: This 2020 Court of Justice of the European Union ruling invalidated the EU-U.S. Privacy Shield and reinforced the need to assess whether data transferred outside the EU receives essentially equivalent protection.
• DORA: In effect since January 2025, the EU’s Digital Operational Resilience Act places requirements on financial organizations and their ICT relationships, including third-party risk, contractual provisions, and exit strategies.
• EU AI Act: The regulation introduces risk-based requirements for AI systems, which is another compliance consideration for enterprises developing and deploying AI in the EU.

For enterprises operating across several markets, data privacy compliance must be a part of your overall architectural consideration rather than a box to check after deployment.

A credible sovereign cloud addresses three forms of control: the data itself, the people operating the environment, and the technology supporting it. Evaluating all three can help you spot where a provider’s protections end.

Data must remain within a specified jurisdiction for storage and processing, with local laws governing its access and use. Physical location alone may not be enough. If a foreign provider controls the infrastructure, its home-country laws could still affect disclosure. Contractual protections and technical controls help address that exposure.

Operational sovereignty concerns who can access and administer the cloud environment. Support, monitoring, encryption key management, and incident response may need to stay within the jurisdiction and be handled by personnel subject to local law. These controls distinguish a sovereign cloud from a standard public cloud region that offers local storage but routes administrative work globally.

Technology can create another form of dependence. Open standards, portable data formats, interoperable APIs, and documented exit procedures give organizations more freedom to change providers. These capabilities also support data governance by giving enterprises greater control over how information is managed throughout its lifecycle.

The right balance across these dimensions depends on the laws governing each workload. Still, assessing all three provides a clearer picture of how much sovereignty a cloud model actually offers.

Sovereign cloud architecture can take several forms. Four models dominate the market, each offering a different balance of cloud capabilities, local control, and cost.

This model combines a global cloud provider's technology with operations managed by a local company. Examples include Delos Cloud in Germany, S3NS in France, and Bleu in France. The local entity controls the environment and personnel access, while the global provider supplies or licenses the underlying technology.

Organizations gain many hyperscaler capabilities while keeping operations within the required jurisdiction. This makes the model a strong option when both service depth and local control matter.

Providers such as OVHcloud in France, T-Systems in Germany, and Aruba Cloud in Italy operate within their respective regions. Their infrastructure, personnel, and legal entities are based locally, which limits dependence on foreign providers.

These sovereign cloud providers may offer fewer services than hyperscalers. However, they can be a better fit when regulations or procurement policies restrict foreign control over cloud operations or technology.

This model keeps data and cloud operations within a selected region while giving organizations access to public cloud services. With Hyperforce, customers can choose where their Salesforce data is stored in supported locations. Hyperforce Operating Zone adds local support for customers in the EU and Switzerland.

This approach fits organizations that need regional control without giving up the cloud products they already use.

Government-community clouds use isolated infrastructure and tightly restricted access for public-sector and national security tasks. Examples include AWS GovCloud and Azure Government. Some higher-classification systems go further by using air-gapped environments that have no connection to public networks.

Keep in mind, though, that greater isolation comes with a trade-off: new commercial cloud services may arrive later or remain unavailable. This model is best reserved for workloads subject to the strictest security or classification requirements.

Greater control often comes with higher costs or fewer technology choices. Before selecting a sovereign cloud, compare those trade-offs with each workload's requirements.

• Higher costs: Local infrastructure, dedicated personnel, and separate operating systems can make sovereign services more expensive than standard public cloud.
• Delayed access to new capabilities: Some products, particularly newer AI services, may reach sovereign environments later or remain unavailable. Organizations should compare regional product availability with their technology plans.
• Sovereignty washing: A provider may market local data storage as a complete sovereignty solution even when foreign laws, globally routed support, or limited exit rights still apply. Ask who operates the environment, who can access it, and how data can be moved.
• Conflicting requirements: National standards define sovereignty differently. A cloud deployment accepted in one country may need additional controls elsewhere, ultimately complicating operations across several markets.

Remember that the strictest option isn't automatically the right one. Match the level of sovereignty to the workload's legal exposure and sensitivity so you don't pay for restrictions the organization doesn't need.

Sovereign cloud is most relevant when sensitive data, critical services, or national security rules limit where information can go and who can access it.

• Government and public sector: Agencies may use sovereign environments for citizen records and defense systems that are subject to strict access or classification rules.
• Healthcare and life sciences: Patient records and clinical research data require close control under standards such as HIPAA in the U.S., HDS in France, and NHS data security requirements in the UK.
• Financial services: Banks and insurers must account for operational resilience, provider concentration, and their ability to recover or move services. DORA places particular focus on these concerns within the EU.
• Critical infrastructure: Energy, telecommunications, transportation, and water providers operate systems whose disruption could affect public safety or essential services. NIS2 and national security rules may add controls to their cloud environments.
• Defense supply chains: Contractors handling export-controlled or classified information may need infrastructure that limits data access to approved locations and personnel.

Industry certifications and regional deployment through Hyperforce can help organizations apply the controls required for these workloads while continuing to use their Salesforce products.

Once an organization defines the level of sovereignty each workload requires, the next step is applying those requirements throughout its environment. Salesforce addresses infrastructure, data policy, encryption, and privacy through several connected products.

Hyperforce deploys Salesforce products in supported geographic locations so customers can choose where their data is stored. Hyperforce Operating Zone adds stricter regional controls in the EU and Switzerland, including local data processing and support by EU-based personnel. Customers can address residency and operational requirements while retaining access to their Salesforce products.

Data 360 Governance controls how structured and unstructured data is managed within Data 360.

• AI tagging and classification: Labels data according to categories such as GDPR, HIPAA, and personally identifiable information.
• Policy-based governance: Applies access rules across Data 360, including Agentforce, analytics, and segmentation.
• Data Spaces: Separates data by region, brand, or business unit within one Data 360 instance.
• Dynamic data masking: Conceals or reveals sensitive information based on the user and applicable policy.

These controls carry sovereignty requirements into the applications and services that use the data.

Salesforce Shield provides Platform Encryption with customer-managed keys, Event Monitoring, and Field Audit Trail. Together, these tools give organizations greater control over encryption and access, along with a detailed record of activity and data changes.

Privacy Center manages consent, retention, anonymization, and deletion requests. Salesforce also uses these products internally. Its approach to protecting data as Customer Zero tests the same security and privacy controls at enterprise scale before customers put them to work.

With regional infrastructure and controls for governance, encryption, and privacy, Salesforce can help organizations build those requirements into the platform. Get started with data residency and sovereignty solutions.