Over the past few years, Dutch organizations have massively made the move to the cloud. Understandably so: scalability, flexibility, and the speed of innovation are simply irresistible. But beneath that digital acceleration lies an uncomfortable question: who does your data actually still belong to?
With rising geopolitical tensions and declining trust in foreign governments, that question is becoming increasingly urgent. Sovereign cloud is therefore no longer a niche solution. It can be a strategic choice for Dutch governments, semi-governmental organizations, and businesses.
The uncomfortable reality of the cloud
Most of the cloud platforms we use every day have been developed by American tech companies. This automatically means that they are subject to US law. And that is where the problem lies.
Legislation such as the US CLOUD Act gives authorities the possibility to request access to data. Regardless of where that data is physically stored. So even if your data is stored in a data center in Europe, it may still be legally accessible to the US government.
There are several areas of concern:
- The biggest legal concern is the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act). This legislation stipulates that US tech companies and their subsidiaries must hand over data on the basis of a US order, regardless of where that data is physically stored.
- Tension with the European GDPR (General Data Protection Regulation). Under this European legislation, personal data may not simply be transferred to foreign governments that do not provide an adequate level of protection.
- Secret requests and ‘gag orders’. Under US law, government actions can be accompanied by a confidentiality obligation (gag order). This means that a cloud provider can be legally required to hand over data to the US government, without the European customer or the affected citizen ever being informed. This naturally conflicts directly with the transparency required by the GDPR.
Geopolitics is turning IT architecture into a strategic issue
What used to be a purely technical choice has today become a geopolitical decision. Europe is largely dependent on non-European cloud providers.
This means that a large part of our digital infrastructure is indirectly influenced by foreign interests.
And this is not without consequences. There are concrete situations in which political decisions have had an impact on IT services and accounts, for example as a result of US sanctions. Two of the better-known examples are:
- GitHub blocks access for users from countries that have been sanctioned by the US. In the summer of 2019, software developers in countries including Iran, Cuba and Crimea were suddenly faced with restrictions on their GitHub accounts. GitHub, the world’s largest platform for sharing and managing source code, is based in the United States and was acquired by Microsoft in 2018.
- Consequences for the International Criminal Court (ICC) in The Hague. When the US imposed sanctions on individual employees and prosecutors of the International Criminal Court, certain officials were no longer allowed to use services such as Microsoft 365, Google Workspace and online banking systems. Tech giants had to block accounts to avoid fines from the US government.
Scenarios that organizations are concerned about:
- What if your IT platform is in the hands of a party that can be put under pressure by a foreign government?
- What if your data is shared with a government, such as the US government, without you knowing about it?
- What if, in extreme circumstances, your systems are no longer fully available?
What is sovereign cloud (and why is it different)?
Sovereign cloud is all about control.
- Data remains within the EU.
- Data is subject to European legislation.
- Management and access are in the hands of European parties.
- Foreign access is minimized.
The objective is clear: organizations can benefit from the advantages of the cloud without losing control over their data.
From a technological perspective, this goes beyond location alone. It can involve ownership or the use of encryption (to make data unreadable to third parties), or, for example, confidential computing, where even the cloud provider does not have access to the data while it is being processed.
Hyperscalers take action
Both AWS (Amazon) and Microsoft are responding to this need.
- AWS developed a European Sovereign Cloud that is managed entirely within the EU.
- Microsoft launched comprehensive sovereign solutions in which data remains in Europe and is under European control.
But the fundamental question remains:
How sovereign is a cloud if the provider itself is not European? Even with technical and organizational measures in place, the debate about legal dependency remains.
OutSystems ODC self-hosted
An interesting development, and possibly a next step in this discussion, was announced during the OutSystems ONE Conference 2026 in Amsterdam:
Self-hosted deployment is available for OutSystems Developer Cloud (ODC). Source: https://www.outsystems.com/product-updates/odc-self-hosted.
This changes the playing field. While many sovereign cloud solutions still run on (adapted) hyperscaler infrastructure, ODC enables a different approach:
- Full deployment in your own data center in Europe,
- or even on your own on-premises servers
- Full control over:
- infrastructure
- data
- runtimes
- network access
Why is this important?
This development addresses exactly the core of the concerns surrounding sovereignty:
- No risk of a foreign government forcing access through the provider.
- No dependence on geopolitical decisions.
- Full control over business continuity.
It therefore aligns perfectly with a need that is becoming increasingly important in Europe: digital autonomy.
Conclusion: the cloud is no longer neutral
Which cloud environment you use is no longer a purely technical choice. It is a strategic choice, with legal, political and economic consequences.
For Dutch companies, this means:
- Think about where your data is stored.
- Understand who can gain access to it.
- Make conscious choices in your architecture.
Sovereign cloud is an important step in this regard. And with developments such as OutSystems ODC self-hosted, full autonomy, for those who want it, is coming a lot closer.
Do you have questions about managing your OutSystems environment? CoolProfs is here to help.
By Stan Visscher, CoolProfs