Digital sovereignty: identity, cloud and AI, hosting in Europe is no longer enough
Our clients tell us: data hosted in Europe by a US provider is not sovereign. And identity is the first building block to protect.
Data sovereignty has become a board-level topic. For our clients, the question is no longer just “where is my data stored?” but “which law applies to whoever hosts it?”. A data centre in Paris or Frankfurt does not protect against extraterritorial laws if the operator falls under a non-European jurisdiction.
Why location is not enough
The US CLOUD Act allows US authorities to require a provider subject to US law to hand over data it controls, including data stored outside the United States. Other laws, such as Section 702 of FISA, govern intelligence collection. EU-US data transfer frameworks have already been struck down twice by the European Court of Justice, and the current framework is still being challenged.
For sensitive data, the relevant criterion is therefore twofold: where the data is hosted, and whether the operator is immune to extraterritorial laws. This is precisely what the French SecNumCloud qualification, issued by ANSSI, requires.
Identity, the first building block of sovereignty
Sovereignty is often discussed for business data, more rarely for identity. Yet identity holds the keys: the identity provider knows every user, their permissions and their sign-ins, and it opens access to the entire information system. An IdP subject to a foreign jurisdiction is a single front door over which you do not have the final say.
- Self-hosted identity provider (Keycloak in particular) on European or SecNumCloud-qualified infrastructure.
- Control of encryption and token signing keys (HSM, key management outside the provider).
- Directories and entitlement repositories hosted under European jurisdiction.
- Hybrid architecture: SaaS for standard use cases, a sovereign foundation for the most sensitive users and applications.
Cloud: choose according to sensitivity
Not everything needs to move to a sovereign cloud, and not everything can stay with a hyperscaler. The effective approach is to classify data and applications, then place each use case at the right level: public cloud, trusted offerings, SecNumCloud-qualified cloud or in-house hosting. Reversibility must be designed from day one: switching IdP or cloud without an exit plan is expensive.
AI: the new frontier of sovereignty
With generative AI, the question arises again, more urgently. Every request sent to a model hosted abroad may contain customer data, contracts or source code. AI agents, which have access to your systems, raise the stakes further.
- European models or open-weight models hosted on controlled infrastructure for sensitive use cases.
- A central AI gateway: users and agents authenticated by your IdP, filtering, logging.
- Dedicated identities and least privilege for each agent, with no shared API keys.
We handle this in the field
- We help our clients classify their data and use cases to decide what must be sovereign and what can stay in SaaS.
- We design and deploy sovereign identity platforms, notably Keycloak on European or SecNumCloud-qualified cloud.
- We build hybrid architectures and exit plans, including from US solutions we know inside out.
- We secure access to AI: authenticated gateway, agent identities, traceability, models hosted in Europe.
Got a technical question on this topic? Our experts will be glad to help you find the answer.