‘Servers in Germany’ alone does not make for a sovereign cloud. This checklist contains ten verifiable criteria you can use to assess any provider – both your current one and any future ones. Rule of thumb: if eight to ten criteria are met, your cloud is sovereign; if fewer than six are met, you face a structural risk that no contract can remedy.
Each criterion can be answered with ‘yes’ or ‘no’ – and with an explanation of how you can verify it with the provider. This turns the marketing term ‘confident’ into a reliable assessment.
| # | Assessment criterion | How to check it | centron |
|---|---|---|---|
| 1 | Data is stored exclusively in Germany/the EU – including backups, replicas and support access | Request the AVV and TOM; enquire about the locations of all copies | ✓ In-house data centre in Hallstadt near Bamberg |
| 2 | No parent company based in a third country – otherwise, laws such as the US CLOUD Act apply despite the servers being located in the EU | Check the commercial register and ownership structure | ✓ Owner-managed German GmbH (HRB 3986) |
| 3 | Own infrastructure – no reselling of third-party hyperscaler capacity | Questions about who owns the data centre and the hardware | ✓ Data centre operator since 2008 |
| 4 | Independently audited cloud security – BSI C5 certificate or equivalent | Requesting an audit report (type, scope, limitations) | ✓ Unrestricted C5:2020 Type 1 (ccloud³ / Managed Cloud) |
| 5 | ISO 27001 certification on the basis of IT-Grundschutz for business operations and data centres | Check the certificate, including its scope | ✓ certified, plus ISO 9001 & 14001 |
| 6 | Legitimate grounds under Article 28 of the GDPR + documented TOM Available without renegotiation | Request the standard general terms and conditions of contract (AVV) before concluding the contract | ✓ Included in the offer |
| 7 | Transparent list of subcontractors – Who else apart from the provider has access to your data? | Check the list of subcontractors in the AVV | ✓ documented in the AVV |
| 8 | Ability to exit – Standard APIs (e.g. S3), data export without penalty traffic charges | Check Egress pricing and API compatibility | ✓ S3-compatible, free external traffic |
| 9 | Support available within your own jurisdiction – A designated contact person rather than an anonymous queue | Try out the support process before you sign up | ✓ 24/7 expert support from Germany |
| 10 | Transparent, consistent prices – no hidden factors that give rise to switching costs | Check the price list for request, egress and additional charges | ✓ Public price list, updated hourly |
The points are deliberately not weighted equally: criteria 1–4 are deal-breakers – if any one of them fails, the cloud is not sovereign, no matter how good the rest may seem. Criteria 5–10 determine how resilient this autonomy is in day-to-day use: during audits, when support is required, and when switching providers.
Try out centron’s top-class cloud service – with a €200 starting credit for the first 60 days.
This promotional offer applies to new accounts only. Available exclusively to businesses.