Data sovereignty is the question an IT lead gets asked on a Friday afternoon: “Marketing wants to try a new AI tool - is it okay?” Behind it sit a vendor contract no one has read, a DPA that references a US parent company, and a quiet transfer of customer names to a server in Virginia. This explainer takes the term out of the brochure: what data sovereignty actually means, how it differs from residency, five concrete examples, what it costs, and how Superkind’s ready-made AI team keeps your data under your control in Outlook, Teams or Slack - hosted in Europe.
Key takeaways
Data sovereignty is control, not storage location - who processes the data, under which jurisdiction, whether they train on it, and who holds the keys. EU hosting alone is not sovereignty.
Residency and sovereignty are different - a US provider in Frankfurt still falls under the US CLOUD Act. A sovereign setup removes foreign-jurisdiction access by design.
Get a ready-made AI team - Superkind comes with Tool Scout, Contract Keeper and Audit Prep. They run automatically on new tool requests, new subprocessor notices and a monthly schedule. Start for free with unlimited users, or build your own.
Keep control, keep your data in Europe - hosted in Europe, GDPR compliant, aligned with the EU AI Act, no training on your data. You decide which steps need approval.
Sovereignty has real costs, not just licence fees - the sovereign tool, migration from a US vendor, ongoing DPAs and audit evidence. Superkind: free to start, Business from EUR 50/month for the whole company. Sovereign cloud premiums are often cited at 10-15 percent over public cloud. As of October 2026.
Your AI team for data sovereignty in daily work
What is data sovereignty?
Data sovereignty is the control an organisation (or a country) keeps over its data: who processes it, under which laws, who can be compelled to hand it over, whether it is used to train someone else’s model, and when it is deleted. It is a question of jurisdiction and control, not only storage: a US provider storing your data in Frankfurt is still reachable under the US CLOUD Act (18 U.S.C. § 2713) regardless of the server’s location9. An example of data sovereignty done concretely is Superkind: an AI team that reads your tasks in Outlook, Teams or Slack and does them in DATEV, SAP Business One, HubSpot and Personio - hosted and processed in Europe, GDPR compliant, no model training on your data.
The one-line test
Ask “who can be forced to give this data to a government that is not ours, under which law?” If the answer includes a foreign jurisdiction because of the vendor’s head office, you have residency, not sovereignty.
Why the word matters now: the EU AI Act (Regulation (EU) 2024/1689) is fully applicable on 2 August 2026, with earlier provisions already in force2,3. The EU Data Act (Regulation (EU) 2023/2854) started applying in September 2025 and tightens how data moves between providers4. More than 350 services carry a Gaia-X label as of 2025, and the BSI’s C5 catalogue is the de facto baseline for cloud security evidence in Germany5,6. For teams in Germany and the EU, sovereignty is no longer a strategy deck - it is a procurement question for every new SaaS signup.
Your AI team for data sovereignty in daily work
Superkind is the AI employee your team writes to in Outlook, email, Microsoft Teams, Slack or the Superkind web app, and it does the task in your programs through 1,500+ integrations such as DATEV, SAP Business One, HubSpot, Personio, lexoffice and SharePoint. Hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act, no training on your data. For programs without an API - abas ERP, RA-MICRO, SAP GUI, Lexware Desktop - Superkind works natively in the browser or the desktop client via Computer Use, inside your own infrastructure. These three employees are ready to use right away; adapt them, or build your own.
You do not start from scratch: Superkind comes with ready-made AI employees that help you keep control of your data every day. They run on their own in the background, triggered by a new tool signup, a new contract or a monthly schedule, and you decide which steps wait for your approval. Use them right away, adapt them, or build your own.
Tool Scout
AI employee for shadow IT and tool intake
Teams sign up for new SaaS tools every week - a transcription app, a design tool, another AI chat - and data walks out of the company before IT hears about it. The Tool Scout watches the shared IT inbox and the credit-card feed, reads each vendor's public DPA and privacy page, flags the hosting region, the subprocessors and whether the vendor trains on customer data. Anything that fails your rules waits for IT in Teams.
+ 1,700 moreContract Keeper
AI employee for vendor data contracts
Data processing agreements sit in SharePoint, expire silently and subprocessors change without anyone noticing. The Contract Keeper watches the DPA folder and every vendor's subprocessor page, flags renewals 90 days before, picks up new subprocessors from the public notices and files the diff in your Company Brain. For anything that moves data to a new country, it asks you in Outlook before signing off.
+ 1,700 moreAudit Prep
AI employee for compliance evidence
Every audit asks for the same evidence - access lists, data flow diagrams, incident logs, DPIAs, TOMs under GDPR Art. 32 - and someone spends two weeks pulling it together. Audit Prep gathers it from SharePoint, your ticket system and the Company Brain every month, fills the recurring template and drops the evidence pack in a shared folder. New gaps show up in Slack so the team can fix them before the auditor sees them.
+ 1,700 more
Every employee is ready to use right away. Or build your own on the platform.
Safe by default
Every task above runs inside Europe, with your rules and your approval where you want them. DPAs, subprocessor lists, audit evidence and vendor assessments - none of it trains external models.
- Hosted and processed in Europe
- GDPR compliant
- Aligned with the EU AI Act
- No training on your data
- DPA through the Trust Center
Send Superkind your first task
Start for free in Outlook, Teams or Slack. Keep the data in Europe from the first message.
From the first task to your own app
With Superkind, data sovereignty grows with the team. Four stages, on a familiar example:
- 1
Ready in minutes
Sign up for free, send Superkind the first vendor DPA from Outlook and watch the Tool Scout read it, pull the hosting region and subprocessors from the vendor’s page and file the result. No training, no project.
- 2
Tasks become routines
What you explain once keeps running: “For every new tool request, check hosting, DPA and training on data - approve under our rules, flag everything else to IT.” Routine checks run on their own; the exceptions wait for your approval.
- 3
Learns from day one
Every task makes Superkind smarter. Your vendors, DPAs, subprocessor lists, incident history and who approves what stay in your Company Brain - and never get lost, even when people leave.
- 4
Your own app, without starting over
When it gets more complex, you build custom solutions, apps with their own interfaces and extra integrations on top of what Superkind already knows - a vendor register, an incident log, a DPIA workbench, your own Super App. Built yourself or together with us. It all belongs to you.
How data sovereignty works
Five parts turn “we are in the EU” into real control. The parts look the same across vendors; what differs is where each one sits and who holds the keys.
- Hosting and processing location - where the servers run and where temporary data (logs, caches, model prompts) is processed. EU hosting is a necessary floor, not the whole answer.
- Provider jurisdiction - the country whose laws the provider itself lives under. A US parent with an EU subsidiary is still subject to US orders like the CLOUD Act; an EU-headquartered provider is not9.
- Access control and keys - who can decrypt the data, who authenticates admin access, and whether support staff in other regions can see live content. Customer-held keys and EU-only admin access tighten this.
- Contracts and evidence - a GDPR Art. 28 data processing agreement, a current subprocessor list, a BSI C5 or ISO 27001 report, and for AI an EU AI Act record of use. These are what an auditor or Datenschutzbeauftragter asks for1,5.
- Use of your data for model training - whether your prompts, documents, invoices and customer data flow into someone else’s foundation model. A sovereign setup is “no training on your data” in writing.
Data sovereignty vs. digital sovereignty vs. AI sovereignty
Digital sovereignty is the broader property - a country or company staying free of dependency on a single foreign vendor across chips, clouds and software. Data sovereignty is one layer of it: control over the data itself. AI sovereignty is the newest layer: control over the models that process your data, the training data behind them and where inference runs. For the AI layer specifically, see our deeper guide to sovereign AI for the Mittelstand.
Data sovereignty vs. residency, hosting location and privacy
Four terms, four different questions. Most vendor pages blur them on purpose, so a short table clears the fog.
| Aspect | Data sovereignty | Data residency | Hosting location | Data protection (GDPR) |
|---|---|---|---|---|
| Question it answers | Who controls the data, under which law? | In which country is the data stored? | In which data centre run the servers? | Is personal data processed lawfully? |
| Scope | Jurisdiction + processing + keys + training | Storage country only | One data centre | Personal data only, EU-wide |
| Reached by foreign authorities? | No, if the provider’s jurisdiction is EU | Yes, if the vendor is US-based (CLOUD Act)9 | Same as residency | Not its question |
| Key reference | Gaia-X, EU Data Act, EU AI Act | Contract clause | Provider’s status page | GDPR (Regulation (EU) 2016/679)1 |
| Enough on its own? | Covers the other three if designed that way | No - does not stop foreign access | No - just infrastructure | No - does not cover jurisdiction |
The honest caveat: sovereignty is not binary. A payroll system holding employee data under GDPR has a higher bar than a marketing analytics tool with aggregated numbers. A sensible rule is to classify tools by the data they touch, then set the sovereignty bar per class rather than one policy for everything.
“AI offers enormous opportunities for companies, regardless of size or industry. The greatest danger is simply ignoring AI and missing the train.”
- Dr. Ralf Wintergerst, President of Bitkom10
Examples: five data sovereignty setups, Superkind first
Five concrete places where data sovereignty gets decided on a Monday morning. The European example comes first.
1. Superkind: AI employees that keep the data in Europe
Daniel forwards a vendor DPA from Outlook. Superkind reads the document, extracts hosting region and subprocessors, checks them against the rules you set and files the result in SharePoint. For every new tool request, the Tool Scout does the same automatically. Hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act, no training on your data, DPA through the Trust Center. See the AI back-office clerk and compliance requests solution pages.
2. Gaia-X-labelled sovereign cloud (IONOS, T-Systems, OVHcloud)
Gaia-X is not a cloud provider - it is a framework that certifies existing providers against sovereignty, interoperability and transparency criteria6. More than 350 services carry the label as of 2025. For workloads where the infrastructure itself has to be sovereign (regulated industries, public sector, healthcare), teams combine an EU-headquartered provider with Gaia-X labelling and often a BSI C5 attestation on top5,6.
3. Microsoft 365 EU Data Boundary
Microsoft operates an EU Data Boundary that keeps customer data processing inside the EU and EFTA for Microsoft 365, Dynamics 365, Power Platform and most Azure services. It is residency with controls, not sovereignty: Microsoft remains a US company and therefore in scope of the CLOUD Act regardless of the EU Data Boundary9,11. Many Mittelstand teams accept this for Office documents while picking EU-headquartered tools for high-exposure workloads (customer data, HR, finance, AI).
4. Sovereign AI stack (Mistral, Aleph Alpha, Nebius EU)
An EU-sourced model running on EU-operated inference infrastructure - Mistral or Aleph Alpha served from a European provider - gives you AI sovereignty on top of data sovereignty. It is useful where the content of a single prompt itself is sensitive (M&A, legal drafts, patient notes). Trade-offs: a thinner model catalogue than the US frontier, and higher per-token cost at low volume. For the fuller picture, see sovereign AI for the Mittelstand.
5. Shared data spaces (Catena-X, Manufacturing-X, Mobility Data Space)
Industry data spaces - Catena-X for automotive, Manufacturing-X for industry, the Mobility Data Space for logistics - build on the International Data Spaces reference architecture7. Each participant stays data-sovereign over its own data and shares it under usage policies that travel with the data. The mechanism scales to suppliers who would never hand over raw data otherwise.
What data sovereignty costs
Three real cost blocks sit behind every sovereignty programme. The table below lists what each vendor publishes on its own pricing page. Not a buying recommendation.
| Cost block | Typical range | What drives it |
|---|---|---|
| Sovereign AI tool (Superkind) | Free to start; Business from EUR 50/month for the whole company | Volume of tasks and credits, not seats |
| Sovereign cloud premium | ~10-15% above standard public cloud (market reports) | Dedicated EU infrastructure, Gaia-X labelling, C5 evidence |
| Migration from a US vendor | Project cost, one-off (varies widely) | Data export, re-integration, user retraining |
| Audit and evidence (C5, ISO 27001, DPIA) | Recurring, depends on scope | Audit firm, internal preparation, document maintenance |
| DPA and legal review | Recurring internal time + external counsel at the margins | Number of vendors, rate of subprocessor changes |
What Superkind costs
As of October 2026. Prices excl. VAT, for the whole company with unlimited users.
- Free - EUR 0, a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and every connection, hosted in the EU.
- Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
- Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, DPA and help with the security review, payment by invoice.
- What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.
Data protection and EU hosting
A sovereignty programme that includes AI touches personal data under the GDPR (Art. 6 and 28) and falls under Art. 4 of the EU AI Act on AI literacy for every person who uses it1,2. With Superkind, the data stays in Europe from the first task, and the evidence an auditor asks for sits in your Company Brain instead of a shared drive. Not legal advice.
How to start with data sovereignty
You do not need a consulting engagement or a five-year strategy. One list, one tool, one week.
Your first week with data sovereignty
- List every SaaS tool that holds customer, employee or supplier data - a shared sheet with vendor, hosting region, DPA on file yes/no
- Mark each one as high (customer or HR data), medium (operational data) or low (public data) exposure
- Pick one high-exposure tool to replace with an EU-headquartered equivalent in the next 30 days
- Sign up for Superkind free at app.superkind.ai (up to EUR 150 in credits) and let the Tool Scout check the next vendor DPA for you
- Agree a rule in writing: “Every new SaaS tool that touches personal data needs EU hosting, a DPA and a ‘no training on our data’ clause before it goes live”
- Put the vendor register, DPAs and evidence in one place (your Company Brain) so audits stop costing two weeks
Conclusion
Data sovereignty is not a slogan on a sovereign-cloud brochure. It is the sum of four decisions you make every time someone signs up for a tool: where the data lives, whose jurisdiction the vendor lives under, who holds the keys, and whether anyone trains on it. The useful next step is small. Pick one tool that holds real customer or employee data, open the integrations list, start Superkind for free at app.superkind.ai and let it check the next DPA for you. In a week you have a baseline and one high-exposure tool under control, with 1,500+ integrations and the data processed in Europe.
Frequently Asked Questions
Data sovereignty is the control an organisation (or a country) keeps over its data: who processes it, under which laws, who can be compelled to hand it over, whether it is used to train someone else's model, and when it is deleted. Where the server stands matters less than whose jurisdiction the provider lives in. A US provider storing your data in Frankfurt is still reachable under the US CLOUD Act.
Residency is only the physical location of the storage ("the data stays in the EU"). Sovereignty asks who controls it: the provider's home jurisdiction, whether support staff in another country can read it, whether your data trains third-party models, and who holds the keys. EU residency without sovereignty still exposes data to foreign access orders, so the two terms are not interchangeable.
No. GDPR focuses on lawful processing, data subject rights, a DPA (Art. 28) and an international-transfer basis (Chapter V); hosting location is one input, not the goal. A sovereign setup adds who controls the keys, the jurisdiction of the provider, what happens when a foreign authority asks and whether your data trains third-party models. Superkind covers all of these: hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act, no model training on your data, DPA through the Trust Center.
Superkind is the AI employee your team writes to in Outlook, Teams, Slack or the web app. It does the task in your programs through 1,500+ integrations such as DATEV, SAP Business One, HubSpot, Personio, lexoffice and SharePoint - and runs natively in programs without an API via Computer Use, inside your own infrastructure. Everything is hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act, with no model training on your data. AI models from OpenAI, Anthropic, Mistral and Google are processed in Europe.
Yes. The CLOUD Act (2018) lets US authorities compel a US-based cloud provider to disclose data in its custody or control, regardless of where it is stored. EU regions and encryption at rest do not remove this reach where the provider holds the keys or operates the service. Choosing an EU-headquartered provider that processes in Europe removes this exposure. Not legal advice.
There are three real costs: the sovereign tool, the migration and the ongoing evidence (DPAs, audits, DPIAs). As of October 2026, Superkind is free to start with a one-off up to EUR 150 in credits, no credit card, and Business is from EUR 50 per month for the whole company with unlimited users - never a price per seat. A full Gaia-X-labelled sovereign cloud stack can run 10-15 percent above a standard public cloud per market reports, before migration. Prices excl. VAT.
Make one list: which SaaS tools hold your customer, employee or supplier data, where each one processes it and whether you have a DPA. Pick one high-exposure tool (an AI tool, your meeting notes, your CRM add-ons) and move it to an EU-hosted equivalent. Give Superkind the first task - "check the DPA for this vendor and tell me where their data lives" - from Outlook, Teams or Slack. In a week you have a baseline and one tool under control, with no consultants.
Sources
- EUR-Lex - Regulation (EU) 2016/679 (GDPR), Art. 28 and Chapter V
- EUR-Lex - Regulation (EU) 2024/1689 (EU AI Act), full text
- EU AI Act - Implementation Timeline
- EU Data Act - Regulation (EU) 2023/2854
- BSI - Cloud Computing Compliance Criteria Catalogue (C5)
- Gaia-X - European Association for Data and Cloud
- International Data Spaces Association (IDSA)
- BMWK - Project Gaia-X and Data Spaces
- US Code - Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 18 U.S.C. § 2713)
- Bitkom - Durchbruch bei Künstlicher Intelligenz (Dr. Ralf Wintergerst)
- Orrick - Data Localization and the Sovereign Cloud: EU Cloud Regulations Explained
Send Superkind your first task.
Start for free in Outlook, Teams or Slack, hosted in Europe. Or see in 30 minutes how data sovereignty runs in your systems.