AWS European Sovereign Cloud: Engineered for trust

For European organizations operating in regulated industries, sovereignty is not an abstract principle – it is a concrete set of risks around data residency, operational autonomy, and jurisdictional reach that must be managed with the same rigor as any security threat. Meeting those requirements effectively demands advanced encryption, fine-grained access controls, and resilient infrastructure, capabilities that are only possible at the scale and depth of a fully capable cloud.The AWS European Sovereign Cloud provides an engineering-led solution to this challenge that delivers a fully independent partition with hardware-enforced isolation, a separate root of trust, EU-only operations, and AWS capabilities inside the sovereignty perimeter. For security architects, that means evidence packages designed to support customer audit processes. For platform teams, it means API-compatible migration paths. For policy stakeholders, it offers a credible technical foundation to answer whether separation can satisfy Europe’s evolving definition of digital sovereignty. For European organizations, it means secure, efficient delivery of essential services across multiple industries and economic sectors.

How we did it: Sovereignty enforced through engineering

The AWS engineering team that built the AWS European Sovereign Cloud focused on trust, which is at the root of the compliance concerns. That clarity led to a clear architectural approach: a fully autonomous, physically and logically separated infrastructure with sovereignty controls built into the architecture. Technical controls, sovereign assurances, legal protections, and operational systems, such as billing and identity and access management, would need to be purpose-built to meet the needs of European governments and enterprises. Foundational infrastructure and systems solutions ensure they do:

• Hardware-enforced isolation with the AWS Nitro System. The Nitro System provides the foundation for all Amazon EC2 instances. By design, the Nitro System has no operator access, so AWS operators cannot access customer data on EC2 instances. Only customers have visibility and control over their own data.
• Dedicated network infrastructure. The AWS European Sovereign Cloud has its own dedicated backbone, managed exclusively by EU-based network engineers. It has independent internet connectivity, dedicated Amazon Route 53 DNS services using European domain extensions (.eu, .de), and its own content delivery network.

A European root of trust. AWS built its first European trust service provider, or certificate authority, for the AWS European Sovereign Cloud. Certificates issued to AWS services or customer endpoints are generated with keys managed entirely within the EU.

• Support for compliance efforts through the AWS European Sovereign Cloud: Sovereign Reference Framework. AWS provides audit-ready technical evidence in the form of pre-built evidence packages that help customers support their compliance efforts under frameworks relevant to public sector bodies, financial institutions (DORA, NIS2), healthcare organizations, and GDPR.
• EU-resident operations. All operational staff are EU residents. All access control systems, including separate Identity and Access Management (IAM) systems, are maintained inside the EU. There is no mechanism for non-EU personnel to access customer data. We are also gradually transitioning the AWS European Sovereign Cloud to be operated exclusively by EU citizens located in the EU.

What this means: the AWS European Sovereign Cloud in action

The AWS European Sovereign Cloud runs the same software, services, and systems as global AWS Regions, including full compute, storage, database, analytics, and machine learning and AI services. We built it to be a full-capability environment, powerful enough to run Amazon.com or train the latest frontier AI models.

European organizations training models on sensitive data can access compute infrastructure where model weights, training data, and inference remain fully within the sovereign boundary. For the customers of Mendix, a market-leading low-code development platform, this means the difference between breakthrough innovations or languishing hypotheses. “Customers can build on Mendix with confidence knowing that by using the AWS European Sovereign Cloud we can address their sovereignty requirements on an operational, data, and technical level,” shared Vice President of Cloud Operations at Mendix, Maarten Smeets.

And in healthcare, where data security and regulatory compliance are paramount, the Department of Human Genetics at Hannover Medical School (MHH) illustrates how the AWS European Sovereign Cloud can support these needs. The department conducts whole genome sequencing to help diagnose some of the rarest diseases in the world and is now evaluating how AI could enhance the patient journey—from analysis to clinical decision support—in ways that must meet strict European data sovereignty requirements. According to Benedikt Schnur, bioinformatics and information technology lead at the Department of Human Genetics, the AWS European Sovereign Cloud may help the team adopt these future AI capabilities while ensuring sensitive genomic data remains protected and compliant. As Schnur notes, “AWS investment in the European Sovereign Cloud is making a huge difference in our work and ensures our data is safe.”

Meanwhile, Dedalus, Europe’s largest healthcare software provider, is using AWS European Sovereign Cloud to rapidly scale healthcare innovation to providers who serve over 540 million patients across more than 30 countries. According to Member of the Board Andrea Fiumicelli, using the AWS European Sovereign Cloud allows Dedalus to “connect systems and data safely across the care continuum while fully respecting national sovereignty and local requirements. Healthcare providers can focus on deploying next-generation solutions rather than compliance, which results in earlier diagnoses and interventions and more consistent end-to-end experiences.”

An infrastructure-first compliance solution

The AWS European Sovereign Cloud represents an engineering approach to a long-standing challenge: delivering full cloud capability within the boundaries of European data sovereignty requirements. With hardware-enforced isolation, an independent root of trust, and EU-resident operations, the architecture addresses compliance at the infrastructure level rather than through policy overlays alone.

Learn more about the AWS European Sovereign Cloud and how it can support your organization’s sovereignty and compliance requirements.