Skip to main content
Manifesto · Sovereign Cloud

Hosted in Europe.
Controlled by Europeans.

Hosting
EU region Paris
Infrastructure: OVHcloud
Parent company
Kopexa GmbH
Based in Germany · no US ownership
Code
KSPEC on GitHub
Open source under the Elastic License v2
Book a demoRead the Sovereign Washing Guide
What makes a cloud sovereign

5 pillars of real sovereignty

What makes a cloud sovereign. Truly.

Four legal properties, one technical. Each must be provable on its own, otherwise all that remains of the promise is sovereign washing. Here is every property with our status.

1. Parent company in the EU

Who legally controls the company? No US group, no US-investor controlling majority, no US listing.

Kopexa status

Kopexa GmbH, based in Germany. No US parent, no US controlling majority. No US law applicable.

2. Data residency in the EU

Data, backups, logs, metadata and all sub-processors must reside in the EU/EEA, with evidence.

Kopexa status

SaaS in the Paris region (EU). Sub-processor list public at /legal/sub-processors.

3. Encryption sovereignty (BYOK)

If the provider holds the key, encryption protects nothing against authority access via the provider.

Kopexa status

Provider-managed keys with AES-256. We do not offer BYOK.

4. Authority access and legal recourse

Which law applies to a data request? CLOUD Act orders must be contractually excluded.

Kopexa status

No US law applicable to Kopexa (no US group in the ownership chain). DPA in self-service at avv.kopexa.com.

5. Code and contract transparency

Black-box providers are risky from a sovereignty perspective. Customers need publicly auditable evidence.

Kopexa status

KSPEC is open source under the Elastic License v2 on GitHub. DPA as self-service at avv.kopexa.com. Sub-processors public at /legal/sub-processors.

Who benefits

Three industries where sovereignty is non-negotiable.

Public authorities & public sector

BSIG Section 8a, IT-Grundschutz, the KRITIS regulation. A sovereign cloud is not a wish but an obligation. Following the DSK ruling, Microsoft 365 is restricted in several German federal states.

  • EU data residency per BSI Grundschutz++
  • No US law for sovereign government data
  • Audit trail per Section 8a (3) BSIG

Banks & financial services

DORA Articles 28-30 require a clear third-party risk assessment. For critical cloud services, BaFin supervision expects the sovereignty question to be answered explicitly.

  • DORA third-party risk covered
  • MaRisk AT 9 outsourcing compliant
  • BaFin notification requirement met

Healthcare & pharma

Patient data, study data and genomic data fall under GDPR Article 9 with elevated protection needs. US cloud solutions are hard to justify here, both to supervisory authorities and to patients.

  • Article 9 GDPR special category data
  • EHDS readiness
  • Automated security tests and vulnerability scans

FAQ

Frequently asked questions about cloud sovereignty

What is a sovereign cloud?

A sovereign cloud meets five criteria at the same time: a parent company in the EU/EEA without a controlling majority from third countries, full data residency including backups and sub-processors in the EU, encryption sovereignty on the customer side via BYOK or HYOK, a contractually committed resistance to third-country authorities, plus code and contract transparency with auditable sub-processor lists.

Where exactly does Kopexa host?

Kopexa runs as SaaS in the European cloud region of Paris. The full sub-processor list is publicly available at /legal/sub-processors.

Is Kopexa subject to the US CLOUD Act?

No. The CLOUD Act applies based on where the parent company is located, not on where the data sits. Kopexa GmbH is based in Germany, with no US parent and no US controlling majority. US authorities have no legal route to compel Kopexa to hand over data. By comparison: US providers with a Frankfurt data center are fully subject to the CLOUD Act, regardless of where the data is stored.

What is Kopexa's position on Schrems II?

Schrems II targets data transfers to the US. Since Kopexa carries out no data processing outside the EU/EEA and has no US group as its parent, the core Schrems II requirements are met. You can sign the data processing agreement (DPA), including standard contractual clauses, directly in self-service at avv.kopexa.com, with no sales contact required.

Does Kopexa offer BYOK (Bring Your Own Key)?

No. Kopexa encrypts with AES-256 and manages the keys itself. We do not offer a connection to your own KMS or HSM.

Does Kopexa have a BSI C5 attestation?

Not currently. The ISO 27001 certification is also in preparation. We already run our ISMS along aligned controls and provide self-assessment documentation on request. Reach out to us directly if certification status is decisive for you.

How do I spot sovereign washing with other providers?

Ask five questions: 1) Where is the beneficial owner registered? 2) Are all sub-processors publicly listed and located in the EU? 3) Is BYOK offered, and in which tier? 4) What contractual guarantee exists for resisting third-country requests? 5) Are the DPA, SCCs and sub-processor list public, or at least transparent during the sales process? Three or more points covered means sovereignty-capable. See the Sovereign Washing Guide for detailed guidance.

What does open source have to do with sovereignty?

Open source enables independent verification. Closed black-box providers are risky from a sovereignty perspective, because customers have no proof that the marketing promises are actually kept on a technical level. Kopexa publishes KSPEC, our compliance check standard, under the Elastic License v2 on GitHub. This makes the core compliance check logic publicly auditable and not tied to Kopexa as a vendor.

Sovereignty with no compromise on functionality.

See the demo, the Sovereign Washing Guide, or the ISMS platform itself.