In an earlier article we described the three questions behind sovereign cloud: where the data resides, who holds the keys, and which jurisdiction applies. This one is about the next step: what a sovereign infrastructure looks like when you actually build it, in Switzerland, in the European Union, or in both.

Four properties, all of them needed

A sovereign infrastructure is one where four things are true at the same time:

  1. Jurisdiction and residency. The provider operates under Swiss or European law, and the data, including backups, logs and monitoring data, stays in the agreed locations.
  2. Operational control. You know who can administer the systems, access goes through your identity provider and every administrative action is logged.
  3. Control of the keys. Data is encrypted with keys whose management you decide, with the strictest level reserved for the most sensitive data.
  4. Portability. Workloads and data use open standards, so that moving them is a planned project rather than a rewrite.

Missing any one of them weakens the others. Data in the right country under an account you cannot audit is not sovereign; a perfectly governed setup built on proprietary services you cannot leave is not either.

Switzerland or the EU: where each workload should live

For companies working on both sides of the border, sovereignty is rarely a single location. It is a rule per application:

  • Swiss zones for data that customers, contracts or sector rules require to stay in Switzerland, and for Swiss entities that prefer Swiss law and Swiss data centres.
  • EU zones for European entities, such as an Italian subsidiary, and for workloads that serve customers in the Union, under the GDPR and, where it applies, NIS2.
  • Both, when a group needs the same application in two jurisdictions, or wants its disaster recovery copy in a different country.

Moving personal data between the two is legally straightforward. The European Commission recognises that Switzerland provides an adequate level of data protection, a finding it confirmed in January 2024, and Switzerland in turn recognises EU and EEA countries as adequate. What matters is to decide, and document, where each data class lives and why, in line with the nLPD and the GDPR.

Using one provider with zones on both sides makes this much simpler: the same tools, the same automation and the same controls, deployed in two jurisdictions.

A reference architecture

For most business applications, a sovereign setup on a Swiss or European cloud provider follows the same pattern:

  • Landing zone as code. Organisation and accounts, roles and permissions, private networks and firewall rules are described with Terraform, reviewed like code and reproducible in another zone or country.
  • Compute. Containerised applications run on managed Kubernetes; what cannot yet be containerised runs on virtual machines in the same private network.
  • Data. Managed PostgreSQL or MySQL with automated backups, and S3-compatible object storage for files, exports and backups.
  • Resilience. Backups are copied to a second zone within the agreed jurisdiction, and restores are tested, not assumed.
  • Observability. Logs and metrics are collected and stored under the same residency rules as the data they describe.
  • Security in the pipeline. Images and dependencies are scanned for known vulnerabilities on every change, as part of the delivery pipeline.
  • An exit plan. For each application, a written note on how data and workloads would be moved to another provider, made easier in the EU by the switching rules of the Data Act.

None of these elements is exotic. What makes the result sovereign is that they are chosen and documented together, with the four properties above in mind.

Why we have partnered with Exoscale

We have signed a partnership with Exoscale, a cloud provider founded in Lausanne in 2011, because it fits this architecture on both sides of the border:

  • Swiss and European zones. Zones in Geneva and Zurich, and further zones in the European Union, including Austria, Germany and Bulgaria: one provider, one set of tools, two jurisdictions.
  • Standard building blocks. Managed Kubernetes, managed databases, S3-compatible object storage and an official Terraform provider: the same interfaces used elsewhere, which keeps workloads portable.
  • Certifications. Exoscale holds ISO 27001 certification, which simplifies the documentation an audit or a customer questionnaire will ask for.

As partners, we design, migrate and operate workloads on Exoscale for our clients. The partnership does not make us exclusive: when another Swiss or European provider, a local region of a global provider or your own infrastructure fits better, we say so.

What global hyperscalers still do better

A fair comparison matters. The large global providers offer a much wider catalogue of managed services, global reach and a vast ecosystem of tools and skills. For workloads that need those services and whose data is not sensitive, they remain a sensible choice. Many companies end up with a mixed model: sensitive data and core systems on a Swiss or European provider, other workloads where the services are best, and a written rule for each application. Highly sensitive AI workloads can go one step further and run entirely on your own infrastructure.

Where to start

Classify your data, decide for each class whether it belongs in Switzerland, in the EU or in both, then choose one application whose sovereignty matters to your customers or auditors and migrate it end to end, controls and documentation included, following the steps in our cloud migration guide. The first application sets the template for the rest. Our sovereign cloud and cybersecurity service does exactly this, on Exoscale or on the provider that best fits your requirements.