European Cloud Only – Geopolitics & Data Sovereignty
Geopolitical tensions, the US CLOUD Act and growing data protection risks raise an uncomfortable question: where does our project data reside – and who can access it?
Digitalisation has made architecture and planning practices dependent on cloud services – for BIM collaboration, project management, communication and data storage. Yet 70% of European cloud infrastructure is operated by US-based providers. In times of geopolitical uncertainty, this is no longer an abstract question: it concerns control over sensitive design data, client information and project communications.
US CLOUD Act
The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) has obliged American cloud providers since 2018 to hand over data upon government request – regardless of whether that data is stored on servers in Europe or the United States. The GDPR protects European users from European authorities, but not from US access under the CLOUD Act.
Three concrete risks for your practice
Legal grey area
The GDPR and the CLOUD Act are in direct conflict. European courts have repeatedly ruled US data transfers inadmissible – yet most practices use US cloud services on a daily basis.
Third-party data access
Designs for public sector clients, security infrastructure or sensitive private projects could become accessible upon government request – without your knowledge or consent.
Provider dependency
Price increases, product discontinuations or geopolitically motivated access restrictions can disrupt your practice overnight – if all data resides with a single provider.
European cloud providers at a glance
| Provider | Strength | Note |
|---|---|---|
| European hosting providers (DE/EU) | Hosting, S3-compatible storage, managed cloud | Fully GDPR-compliant, data centres within the EU |
| European IaaS providers (EU) | IaaS, Kubernetes, object storage | ISO 27001 certified, enterprise-grade infrastructure |
| Cost-effective EU compute providers | Cost-effective compute and storage | Ideal for smaller practices, excellent value for money |
| Enterprise EU cloud platforms | Enterprise cloud for compliance-critical workloads | Particularly suited to compliance-critical applications |
| Self-hosted collaboration platforms | Self-hosted collaboration platform | Maximum data control, on-premise or with EU host |
A pragmatic cloud strategy
A complete migration to European providers is not yet realistic for most practices – US services are too deeply embedded in daily workflows. But a deliberate strategy is long overdue: which data is particularly sensitive? Which services could be replaced by European alternatives? And where is dependency on a single provider too great? Every architecture and planning practice should be able to answer these questions today.
Our Verdict
The US CLOUD Act is binding law and applies to data on European servers of US providers – a structural risk.
European cloud providers are capable enough for professional use – choosing them is a deliberate strategic decision.
Concentrating all project data with one US provider exposes your practice to geopolitical, legal and operational risk.
A hybrid strategy – critical data on EU infrastructure, non-critical workflows on US services – is the pragmatic step.
Cloud sovereignty is not an ideological issue – it is a pragmatic question of risk management. Practices that reconsider their data strategy today protect their clients, their projects and their independence.
Frequently asked questions on cloud sovereignty
Share this article
Your cloud strategy
under scrutiny?
We help you develop a pragmatic cloud strategy – identifying which data should reside where and which European alternatives make sense for your practice.