A Dutch data centre with an American owner is not sovereignty

"Dutch data centre" now appears on almost every cloud page. It sounds reassuring, and for the question "is my data in the Netherlands" it is often true. But it is not the same as sovereignty. A data centre is a building; sovereignty is about control. And control follows the owner, not the floor tile.

The sovereign cloud workspace costs €38 per user per month + Microsoft 365 Business Premium €19.56 = €57.56 all-in; already have Business Premium, then you only pay the €38. Your desktop, files and applications run on AVD on our own servers in Eindhoven and Den Bosch, managed by a Dutch team. AVD stands for Azure Virtual Desktop, Microsoft's workspace technology. See sovereign cloud workspace.

Where the disk sits is not where the law sits

The US CLOUD Act of 2018 regulates something uncomfortable: a company under US jurisdiction can be compelled by the US government to hand over data — even when that data physically sits in the Netherlands. The same applies through FISA Section 702 for certain surveillance requests. Physical location is not a lock; the owner and the jurisdiction of that company are.

That means a "Dutch data centre" tells you little as long as you do not know who owns the company behind it. If your cloud runs on the infrastructure of a US hyperscaler, or the provider is a Dutch name with an American parent or investor, then US jurisdiction travels along — the tiles in Amsterdam or Eindhoven change nothing about that.

The question is not "where", but "whose"

In an earlier article on digital sovereignty we split the question into four layers: where the data sits, who manages it, who owns the technology, and whose hardware it runs on. The CLOUD Act mainly touches the last two. You can have data sovereignty — the location — perfectly in order and still have no infrastructure or operational sovereignty, simply because the owner sits outside the EU.

For most SMEs this is not a political point but a procurement risk. Care providers, accountants, law firms and government suppliers now get the question straight into their contracts: under which law does our data fall, and can a foreign party reach it? "Our data centre is in the Netherlands" is then no longer a sufficient answer.

Where we stand

Virtual Computing is a Dutch company, in Dutch hands. We do not run our Online Workspace on a hyperscaler's infrastructure, but on our own servers in our own twin data centre in Eindhoven and Den Bosch. Your desktop, your files, your applications and their backups sit on our hardware, which we own and manage. There is no foreign parent that can be compelled to hand over that data, because there is none.

One thing we keep honest, because it belongs to the full picture. The workspace itself runs on AVD, Microsoft's workspace technology, and signing in goes through your Microsoft 365 account. That identity and licensing layer runs at Microsoft, within the European data boundary. The difference with an ordinary public cloud is where your work lands: your documents, your data files and your line-of-business software run and sit with us, not in a hyperscaler environment. Microsoft orchestrates access and security, but does not hold the content. That is the layer where the CLOUD Act question bites hardest, and that is exactly the layer we keep to ourselves.

If you also want to shield that identity layer further, heavier variants are possible. For the vast majority of SMEs the setup above is the right balance between sovereignty and simply being able to work with Microsoft 365. We are happy to advise on what fits your requirements.

Three questions to test your current provider

To find out how sovereign you really are, ask your provider these three questions:

1. Who owns the company that manages my data, and under which law does that company fall? Not where the data centre sits, but who owns the provider.
2. Does my workspace run on its own infrastructure, or on a hyperscaler's cloud? That determines whether a foreign jurisdiction travels along.
3. Where are my backups and my logging, and under whose management? Sovereignty often leaks away through the back door of the backup.

A provider that answers these three clearly and in writing takes the question seriously. One that keeps falling back on "our data centre is in the Netherlands" is answering a different question than the one you asked.

In short

A Dutch data centre is a good start, but not proof of sovereignty. Control follows the owner and the jurisdiction, not the location of the disk. With our Online Workspace and sovereign cloud workspace your work runs on hardware that we, as a Dutch company, own ourselves, beyond the reach of the large foreign providers. Read more about the technology behind it on Azure Virtual Desktop.

Curious how sovereign you are today, or what switching would mean? Call 085 013 4500 or request a call-back.