What Does a 'Sovereign Cloud' Really Mean?

A month ago, Canadian Prime Minister Mark Carney briefly mentioned that his new Major Projects Office would be supporting the development of a “Canadian sovereign cloud” in an address outlining nation-building projects. This news reflects a much broader conversation around digital sovereignty for Canada, yet it offers little specificity on what a Canadian sovereign cloud would actually entail.

Meanwhile, American hyperscalers, including Google, Amazon Web Services (AWS), Microsoft and Oracle, that dominate cloud infrastructure across the globe have taken note of the recent turn toward sovereignty. They have been quick to try to capitalize on it. Just days after Carney’s address, Google issued a press release unveiling its new “Sovereign Cloud” offering for Canadian consumers. The product promises data localization through measures such as the so-called “Google Data Boundary,” which is tailored for “Government of Canada Sensitive Workloads” and allows customers to set up ​​data residency and access controls. But can a cloud built and run by a foreign provider, however tailored, truly be called sovereign?

This trend is hardly unique to Canada, and if anything, we are late to jump on the cloud sovereignty bandwagon. The hyperscalers have been marketing “sovereign” cloud solutions in Europe for nearly a decade, beginning with Microsoft’s Deutschland Cloud, which operated from 2015 to 2018. The initiative sought to increase data protection by placing control of customer data under a third-party German trustee. More recently, AWS announced plans for a 7.8 billion euro European Sovereign Cloud, slated to launch by the end of this year. Yet, as critics have correctly pointed out, this project is but a facade that conceals the fundamental inability of US companies to provide true data sovereignty in Europe, or anywhere else.