Buyers of sovereign infrastructure navigate an overlapping set of European and German frameworks. They are not the same thing (some are law, some are standards, some are labels), but they converge on one requirement: demonstrable, auditable control over your own systems.
This page is an educational overview to orient a procurement or security team. It is not legal advice, and it does not assert any certification status for this platform. For what a specific regulation requires of your programme, involve your compliance and legal functions.
The frameworks, in plain terms
DSGVO / GDPR
The EU General Data Protection Regulation (Datenschutz-Grundverordnung) governs personal-data processing. For infrastructure, the relevant pressure is on international transfers and processor control: personal data flowing to a provider under foreign jurisdiction (e.g. the US CLOUD Act) is a transfer-risk problem that residency claims alone do not resolve.
NIS2
The EU NIS2 Directive raises cybersecurity obligations for essential and important entities: risk management, supply-chain security, incident reporting, and accountability at management level. It pushes operators toward infrastructure they can secure, monitor, and account for end to end, including their software supply chain.
IT-SiG 2.0 (Germany)
The second IT Security Act expands the duties of operators of critical infrastructure (KRITIS) in Germany, including attack-detection requirements and stronger BSI oversight. It reinforces the need for auditable, controllable platforms rather than opaque managed services.
BSI IT-Grundschutz
The German Federal Office for Information Security (BSI) publishes IT-Grundschutz, a comprehensive baseline-protection methodology and control catalogue. It is the practical yardstick many German public-sector programmes align to. Open, self-hosted infrastructure is straightforward to map to Grundschutz modules because you control (and can evidence) the whole stack.
Alignment vs. certification. "Maps cleanly to Grundschutz modules" is a design property. A formal BSI certification or C5 attestation is a separate, audited status. We describe alignment where it is true and never imply a certification we do not hold.
Gaia-X
Gaia-X is not a law but a European initiative defining a framework and labels for sovereign, interoperable data infrastructure. Its criteria emphasise transparency, portability, and provider independence. Open, self-hostable platforms satisfy these properties structurally.
The common thread
Read together, these frameworks are not asking “is the datacenter in-country?” They are asking:
- Can you see what your infrastructure does? (auditability)
- Can you secure and monitor it end to end? (control)
- Can you evidence all of the above to a regulator? (accountability)
- Are you free of foreign compulsion over the system? (jurisdiction)
That is the same definition of sovereignty arrived at from a legal direction: open, self-hosted, controllable, with no foreign root access.
What to ask a platform vendor
- Can you evidence the full software supply chain (SBOMs, reproducible builds)?
- Can the platform run air-gapped for the most sensitive workloads?
- Does the architecture map to BSI IT-Grundschutz modules, and where are the gaps?
- What foreign jurisdiction, if any, touches the operator or control plane?
Bring those questions to your compliance team early. The answers shape which frameworks you can satisfy and how much evidence you will have to produce.