Find the right AI use cases before investing in development.
Connect AI to your existing systems and workflows.
Build autonomous AI agents that automate complex tasks.
Design and develop AI solutions tailored to your business.
Build secure, scalable AI systems for enterprise environments.
Legacy software modernization →
Upgrade outdated systems for better performance, security, and scalability.
Make informed technology decisions before investing in development.
Validate your product idea with user and business insights.
Define the right scope to launch faster and reduce risk.
Confirm your idea is technically viable before you build.
Capabilities
Want to start a software project with us?
Book a time with our technology experts →
We brought young developers together to explore the future of AI agents. More editions are coming soon.
DEDigital sovereignty means you decide who controls your data, your infrastructure and the software you depend on, and you can change those decisions when you need to. It covers four layers:
The goal is to keep your options open, without isolating yourself.
There’s no single legal definition yet, so ask four questions:
Most offers are strong on some of these layers and weaker on others.
Data residency is about location: your data is stored in a specific country or region. Data sovereignty goes further. Your data is subject only to the laws of the jurisdiction you choose, and nobody outside it can compel access.
Digital sovereignty is the widest term. It covers data plus infrastructure, software, operations and your ability to switch providers.
A quick test: data in the Frankfurt region of a US provider has residency. Whether it also has sovereignty is a legal question, because US law can still reach the provider. See digital sovereignty vs. data sovereignty in detail.
No. Sovereignty is about controlling the most important data.
Many companies keep Microsoft 365 or a hyperscaler for less sensitive workloads and move regulated data, customer systems and critical applications to European providers. The CEO of Gaia-X estimates that only around 10% of workloads truly need EU-only providers.
Decide workload by workload. What happens if a foreign authority requests this data, or the provider changes its terms? Your answer tells you where each workload belongs.
It’s a question of degree. Full sovereignty, with an EU supply chain all the way down to the hardware, isn’t realistic today for most companies.
A more practical target is sovereignty per workload. Regulated data and critical systems get the highest level of control, and everything else gets a pragmatic choice.
In practice, that means a tiered setup: European providers for sensitive workloads, portable technology everywhere, and a switching plan you’ve tested. The first step is knowing which tier each system belongs in. Take our digital sovereignty self-test to see where you land.
No. Mid-market companies are often more exposed. They tend to rely on a single hyperscaler, and they rarely have a large platform team to plan an exit. It usually lands on the agenda for three reasons:
It can. The CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) lets US authorities compel US-based providers to disclose data in their “possession, custody or control,” wherever it’s stored. That includes data held by EU subsidiaries of US companies. So if a US provider controls your data in say, Frankfurt, the law can reach it.
Hyperscalers say they challenge requests and that access isn’t automatic. But in June 2025, Microsoft France told the French Senate it couldn’t guarantee that data would never be handed over. EU-owned providers are outside the CLOUD Act’s direct reach.
It can. GDPR sets strict conditions for transferring personal data outside the EU. A CLOUD Act order can require a US provider to hand that data over anyway. That leaves the provider caught between two legal systems, while you, as the data controller, remain accountable under GDPR.
This is why transfer risk assessments matter. You need to document which data could be exposed, how likely that is, and which safeguards reduce the risk. Encryption with keys that only you hold is one of the strongest.
For now, it’s a valid legal basis for transfers. For long-term planning, it’s a risk. The EU General Court upheld the EU-US Data Privacy Framework (DPF) in September 2025. As of September 2026, an appeal is pending at the Court of Justice of the EU (CJEU). The two frameworks before it, Safe Harbor and Privacy Shield, were struck down in 2015 and 2020. US surveillance law also keeps changing.
The sensible approach: use the DPF where it fits, but don’t design critical systems on the assumption that it will survive.
No. GDPR allows transfers outside the EU under an adequacy decision (like the DPF for certified US companies), standard contractual clauses (SCCs) or other safeguards.
What GDPR does require is accountability. You have to know where personal data goes, justify each transfer and assess the risks. Keeping data in the EU with an EU-owned provider makes all of that much easier to document.
Some sector rules go further. In Germany, §393 SGB V requires C5 attestation from the Federal Office for Information Security (BSI) for cloud processing of health data.
They set different requirements:
It makes switching cheaper. The EU Data Act has applied since 12 September 2025. During the transition period, providers can only charge switching fees at cost, and that includes egress fees (what you pay to move data out). From 12 January 2027, switching charges and switching-related egress fees are banned for infrastructure, platform and software services.
Two caveats. Existing contracts don’t update automatically, so check yours. And as of September 2026, the EU’s Digital Omnibus negotiations may exempt some contracts signed before September 2025 and allow early-termination penalties in fixed-term contracts.
The AI Act doesn’t require your data or models to stay in the EU. The link to sovereignty is control. Depending on the risk level, the Act asks for documentation, logging and transparency.
That’s much easier when you decide where the model runs, which model you use and what gets logged. Key dates to remember, as of September 2026:
Read what the EU AI Act means for software development in more detail.
Operationally, it’s a clear step forward. Legally, the question is still open.
The AWS European Sovereign Cloud launched in January 2026 in Brandenburg, Germany, backed by a €7.8 billion investment. A separate German company runs it, with EU-resident staff and leadership. That’s a real improvement in data location and operational control.
Its ultimate owner is still a US company, though, so whether the CLOUD Act can reach it is still debated. It also launched with about 90 services, compared with 200+ in standard AWS regions.
It suits some workloads well. For others, an EU-owned provider is the safer choice.
Both are useful steps, and both still have a US parent company.
These offers usually cost more than the providers’ standard regions.
There are several, and the right one depends on the workload. The ones we work with most:
We also work with Hetzner, noris and Mittwald. See how we match providers to workloads in more detail.
Yes, for most production workloads.
The established providers hold the attestations regulated buyers look for. STACKIT and IONOS both offer products with BSI C5 attestations. C5 is the German cloud security standard that the public sector requires in practice, and healthcare, finance and critical infrastructure operators often expect it too. STACKIT also holds TISAX, which matters if you supply German carmakers.
The bigger differences are in the range of managed services, so check the specific services you rely on. And plan for failures the way you would on any cloud: redundancy, tested backups and monitoring.
Mostly the range of managed services. Compute, storage, Kubernetes and databases like PostgreSQL are well covered. The gaps are in:
In the Bitkom Cloud Report 2026, 43% of companies said there were no equivalent EU alternatives for their needs. That’s often true for a single service and less often for a whole workload, because open-source tools like ClickHouse for analytics can close many of these gaps.
It’s the European Commission’s scoring model for cloud sovereignty. It rates cloud offers from SEAL-0 to SEAL-4 across eight objectives: strategic, legal and jurisdictional, data and AI, operational, supply chain, technology and openness, security and compliance, and environmental.
The Commission used the framework for its first sovereign cloud tender, awarded in April 2026 (up to €180 million over six years). SEAL-2 was the minimum, and most winning consortia reached SEAL-3.
Full SEAL-4 requires an EU supply chain down to the hardware, which is practically out of reach today. For you, the framework is a useful checklist when you compare providers.
Not necessarily. For plain infrastructure, storage and Kubernetes, European providers are often cheaper than hyperscaler on-demand prices.
Costs go up when you rely on managed services that don’t exist in Europe and have to be rebuilt or run yourself. The hyperscalers’ own sovereign offerings usually cost more than their standard regions.
Budgets are tight. In the Bitkom Cloud Report 2026, only 12% of companies would accept a 10 to 20% premium for sovereignty. That’s why we compare your current bill workload by workload before we recommend anything, egress fees included. See what our Cloud Analysis compares in more detail.
Your risk exposure grows slowly:
The market is moving too. Gartner expects European spending on sovereign cloud infrastructure to grow 83% in 2026, to $12.6 billion. Doing nothing is a decision as well. Make sure it’s a deliberate one.
Yes. A discount lowers today’s bill, but doesn’t reduce your dependency. The practical move is to plan around your contract end dates. Map what could move, what it would cost and when the timing works.
You don’t have to leave your provider entirely. Many companies keep the enterprise agreement for workloads that belong there and move the rest in waves as terms expire.
Coming to a renewal with a credible alternative also changes the conversation with your account manager.
Leadership wants three things: risk, cost and a plan. Cover them in that order.
Our Cloud Analysis gives you exactly this: a decision brief of about 10 pages for leadership, backed by a technical appendix for your engineers.
No. Not everything has to move, and not everything should. We sort your workloads into three groups:
Then we match each group to how much sovereignty it needs. Regulated data and critical systems come first. Low-risk workloads can stay where they are.
The ones built on proprietary managed services:
Object storage is usually the quickest win. S3 and Blob storage move to S3-compatible European storage with few changes.
It depends on the size of your environment and what sits at its core. Typical ranges:
Before that comes the Cloud Analysis, which takes 2 to 6 weeks depending on the complexity of your environment.
We migrate in waves. After the analysis, you get a fixed price range for each wave, so you know the cost before you commit. See how our migrations work in more detail.
That’s what our planning is designed to prevent. We don’t do overnight big-bang switches.
In every wave, the new environment runs in parallel with the old one, data stays in sync, and traffic moves over step by step once tests pass.
Every wave also has a rollback plan. If something doesn’t behave as expected, you switch back. No migration is completely risk-free, but running in parallel keeps the risk small and reversible.
A cloud exit strategy is a documented plan for moving a workload away from its current provider.
It covers where the workload goes, how the data moves, how long it takes, what it costs and who does what. DORA makes a tested exit strategy mandatory for financial entities. For everyone else, it’s good practice.
Testing means running parts of the plan for real:
Make portability a design rule from the start:
You can still use proprietary services. Just do it knowingly, where the benefit is worth the exit cost. Read our guide to avoiding vendor lock-in.
Yes. You choose where the model runs, in your own data center or on a European cloud.
You also choose the model: European, open-source or commercial, and you can swap it later. Your prompts and documents stay in that environment and don’t train anyone else’s models. Permissions and logging are built in, so people only see what they’re already allowed to see.
Most companies start with an internal AI assistant or a search tool over internal documents that shows its sources.
EU-hosted model options include IONOS AI Model Hub, STACKIT AI and Telekom’s Industrial AI Cloud in Munich. See how we build sovereign AI systems.
For a lot of enterprise tasks, yes.
Summarizing documents, answering questions from internal knowledge, drafting and classifying all work well with current open-weight models and European models like Mistral’s. The leading commercial models still have the edge on complex tasks.
That’s why we keep models swappable. You start with one, test it on your own data in a 4 to 8 week pilot, and switch later without rebuilding the application. Before the pilot, a use-case and data check takes 2 to 3 weeks. Read about running LLMs locally.
It can be, with caveats.
When you run open-weight models like Meta’s Llama or Alibaba’s Qwen on EU infrastructure, the model runs locally and no data flows back to the vendor. That settles the data question.
Three things still matter:
To reduce that dependency, pick a European model or design your setup so you can switch models easily.
No. Most companies are in the same position, and that usage shows you where the demand is.
You don’t have to ban the tools people like. A combination works well: Copilot for everyday Office tasks, and a sovereign AI tool for sensitive company knowledge like contracts, customer data and internal documents. Once people have a good option for sensitive work, unofficial use is much easier to control.
We provide the documentation you need for the data protection impact assessment (DPIA), your data protection officer (DPO) and your works council.
Start with a free 30-minute call with Senior Consultant Miki, who advises on sovereignty, DORA and audit requirements.
You’ll talk through your setup, your regulatory context and why the question is coming up now. If a Cloud Analysis makes sense, you get a binding fixed price after the call.
The analysis takes 2 to 6 weeks, depending on the complexity of your environment, and can start 2 to 3 weeks after signing. Would you rather write first? Send us a few details and you’ll get a first assessment within 24 hours. Get a first assessment
Yes, as one building block. It doesn’t replace certification or your own risk assessment.
The Cloud Analysis documents your architecture, dependencies, providers and costs, along with your options for moving each workload. That gives you a solid basis for DORA exit strategies and concentration risk assessments, and for NIS2 supply chain risk management.
Auditors will still expect your own governance and, under DORA, a tested exit plan. We’re ISO 27001 certified ourselves, so we document to the standard auditors expect. The results belong to you.
We’re an EU company with offices in Düsseldorf and Zagreb. Our 90+ experts have been building software for 14 years. Our contracts fall under Croatian law, so EU law applies throughout. If you need it, we can also work under your local jurisdiction.
In Germany, we’re members of the mid-market association BVMW and of Digitale Stadt Düsseldorf.
