EU Data Residency and Data Sovereignty Are Not the Same Thing

If you’re evaluating infrastructure for EU compliance reasons, you’ve probably seen the terms “data residency” and “data sovereignty” used as if they mean the same thing. They don’t, and the difference matters more than most vendor pages let on.

Residency is about where your data physically sits. Sovereignty is about whose laws govern it, and who can compel access to it, regardless of where it sits. A provider can give you the first without being able to promise the second, and a lot of marketing language quietly blurs that line.

If you’re a technically savvy buyer trying to make an infrastructure decision for GDPR, DORA, or general EU compliance reasons, it’s worth understanding exactly what each term guarantees before you pick a vendor based on the wrong one.

What Data Residency Actually Means

Data residency means your data is physically stored and processed within a specific geographic boundary, in this case, the EU. If your infrastructure provider operates a data center in Amsterdam and your workloads run there, you have EU data residency. That’s a factual, verifiable claim: you can point to the facility, the country, the jurisdiction where the servers sit.

Residency answers questions like:

• Where is my data physically located?
• Does it ever leave this region, even for backups or replication?
• Which country’s data protection authority has physical jurisdiction over the facility?

For most GDPR compliance programs, residency is a real and meaningful requirement. Article 44 and the broader Chapter V restrictions on international data transfers are largely about controlling where data physically goes and under what safeguards. A provider that keeps your data in an EU facility, with no unannounced replication elsewhere, is solving a genuine part of that puzzle.

What residency does not answer is who can be legally compelled to hand that data over, or grant access to it, regardless of where it sits.

What Data Sovereignty Actually Means

Sovereignty is a claim about legal jurisdiction, not physical location. A truly sovereign cloud would mean your data and the systems processing it are entirely outside the reach of any foreign government’s legal authority, including subpoenas, national security orders, or mutual legal assistance requests directed at the company operating the infrastructure, not just the data center.

This is where things get complicated for a lot of providers marketing “sovereign cloud” services in Europe, including the EU regions of major US hyperscalers.

The reason is the CLOUD Act. The US Clarifying Lawful Overseas Use of Data Act, passed in 2018, gives US law enforcement the authority to compel US-based companies to produce data they control, regardless of where that data is physically stored. If a company is headquartered in the US, or is a subsidiary that a US parent company controls, the CLOUD Act can reach its data no matter which country the servers sit in.

That means a US company’s “EU region” can satisfy data residency. It generally cannot satisfy full sovereignty, because the parent entity remains within reach of US legal process.

Why This Distinction Gets Blurred in Marketing

Providers have an incentive to use “sovereign” language because EU buyers, particularly in financial services, healthcare, and government-adjacent sectors, are actively searching for it. Regulations like the EU AI Act and DORA have pushed vendor evaluation and third-party risk assessment further up the priority list for a lot of technical and compliance teams, and “sovereign cloud” reads as a checkbox that solves the problem in one word.

But a straightforward reading of the CLOUD Act’s own text says otherwise for any provider with US corporate ownership. Several major cloud providers have introduced EU-branded sovereign offerings in the past few years, typically involving EU-based subsidiaries, local data trustees, or restricted operational models designed to limit exposure. These efforts can meaningfully reduce risk. They do not eliminate the underlying jurisdictional reality: if the parent company is American, US legal process can, in defined circumstances, reach it.

This isn’t a criticism specific to any one vendor. It’s a structural fact about corporate ownership and national jurisdiction that applies to OpenMetal too, and we’d rather say so directly than let the term do work it can’t back up.

Where OpenMetal Fits, Plainly Stated

OpenMetal operates a data center in Amsterdam, Netherlands. Workloads deployed there, whether on hosted private cloud or dedicated bare metal, run in the EU, and customer data stored there stays there. That’s real data residency, and for a lot of EU-facing compliance and latency requirements, it’s the part that actually matters operationally.

We are a US company. Like every US-headquartered infrastructure provider, we’re subject to US legal process, including the CLOUD Act. We’re not going to tell you otherwise, and you should be skeptical of any provider with US ownership who does.

What we can tell you is what our architecture actually limits:

• You get full root access to dedicated, single-tenant hardware. We don’t run your workloads inside a shared platform we control.
• We don’t hold your encryption keys or have standing credentials into your environment.
• On TDX-capable hardware, your data can remain encrypted even while it’s in use, not just at rest or in transit, which limits what’s technically accessible even under legal compulsion.

Full facility details, including physical security and network specifics, are on our Amsterdam data center page.

None of that changes our jurisdictional status. It does mean that a request for data we hold is a narrower thing than a request for data inside a fully managed public cloud platform, where the provider often has broader technical access to customer environments by design.

What This Means for Your Decision

If your requirement is EU data residency, meaning your data physically stays in the EU, is subject to GDPR as the applicable framework, and isn’t quietly replicated to a US region for convenience, that’s a real, deliverable, verifiable thing. Ask any provider exactly which facility your data lives in, whether it ever leaves that facility, and get that in writing.

If your requirement is genuine sovereignty, meaning no US legal process can ever reach your data under any circumstance, then the provider needs to be a non-US-owned entity with no US parent, full stop. No amount of EU infrastructure changes that if the company itself is American.

Most compliance programs, once you dig into the actual regulatory text rather than the vendor marketing, are asking for the first thing. It’s worth confirming which one your legal or compliance team actually needs before you evaluate vendors, because the two questions lead to very different shortlists.

If EU data residency is the actual requirement, you can check current configurations and pricing on our bare metal pricing page or model out a private cloud deployment with the cloud deployment calculator.

FAQ

Is data residency the same as data sovereignty?

No. Data residency refers to the physical location where data is stored and processed. Data sovereignty refers to which country’s laws govern that data and who can be legally compelled to produce it, which depends on the provider’s corporate jurisdiction, not just the data center’s location.

Can a US company offer real data sovereignty in the EU?

Generally, no. Under the CLOUD Act, US law enforcement can compel US-based companies, including their foreign subsidiaries and foreign-stored data in some circumstances, to produce data they control. A US-owned provider can offer EU data residency but cannot offer full legal sovereignty from US jurisdiction.

Is OpenMetal a sovereign cloud provider?

No, and we don’t claim to be. OpenMetal is a US company subject to US legal process. We do offer EU data residency through our Amsterdam data center, along with dedicated hardware, customer-controlled encryption, and TDX confidential computing that limit what’s technically accessible in your environment.

Does GDPR require data sovereignty or data residency?

GDPR’s international transfer rules are primarily concerned with where data goes and what safeguards apply, which aligns more closely with residency and processing location than with full jurisdictional sovereignty. Confirm the specific requirement with your legal or compliance team, since obligations vary by data type and use case.

What actually protects my data if a provider is subject to foreign legal process?

Technical controls that limit what the provider itself can access, such as customer-held encryption keys, dedicated single-tenant hardware instead of shared platforms, and confidential computing technologies like Intel TDX that encrypt data even while it’s in use. These narrow what could be produced even in response to a valid legal request.