Case study
Sovereign Cloud
Sovereign Cloud with Google: the right tier for your data
Not every application needs the same degree of sovereignty. Google offers a tiered model – from the public cloud with data residency in Germany, through Google Cloud Data Boundary and Google Cloud Dedicated with Thales, to the fully separated air-gapped solution. We work with you to find the right tier and implement it.
- Sovereignty assessment for your applications and data
- Clear classification: which tier for which need
- Implementation and operations – also with partners such as Thales
In brief
Sovereign cloud means: you decide where your data is stored, who holds the keys and who operates the platform. Google offers four tiers for this: the public cloud with data residency in Germany, Google Cloud Data Boundary with your own control over keys and access, Google Cloud Dedicated as separate infrastructure – operated in Germany by Thales – and Google Cloud Air-Gapped with no connection to the outside at all. Which tier fits depends on the protection needs of each individual application.
Tiered model
Four tiers of sovereignty
The higher the tier, the more control lies with you or a European operator – and the more specialized operations become.
- Tier 1
Public cloud with data residency in Germany
Google Cloud with regions in Frankfurt and Berlin, Google Workspace with the Europe data region. Sufficient for most business applications.
- Tier 2
Google Cloud Data Boundary
Define data location and access precisely: data stays in the EU or in Germany, keys are managed externally and access is only granted with a justification. Optionally, a partner monitors keys and audits – in Germany, T-Systems, for example.
- Tier 3
Google Cloud Dedicated
Separate, dedicated Google Cloud infrastructure operated by an independent European partner. In Germany, the operator is a new German company wholly owned by Thales. Available in preview. According to Thales and Google, general availability is planned for the end of 2026 – realistically, we expect Q1 2027. In France, S3NS operates the offering.
- Tier 4
Google Cloud Air-Gapped
Fully separated in your own data center, with no connection to Google or the internet. The solution cannot be switched off by Google – for defense, security authorities and critical facilities.
| Public cloud | Data Boundary | Dedicated | Air-Gapped | |
|---|---|---|---|---|
| Infrastructure | Shared Google data centers | Shared, with fixed boundaries | Separate, dedicated infrastructure | In your own data center |
| Operations | Google, optionally with partner oversight | European partner, e.g. Thales | Customer or contracted partner | |
| Keys | With Google or the customer | External, with the customer or partner | With the operator | With the customer |
| Connection to the outside | Internet | Internet | Separated from Google | None |
| Range of services | Full | Large share of services | Selected services | Selected services |
| Typical for | Most companies | Regulated industries | Critical infrastructure, healthcare, public sector | Defense, authorities |
Rule of thumb: as much sovereignty as necessary, as much cloud as possible. We work out which tier suits which application in the sovereignty assessment.
Germany
Google Cloud with Thales: the sovereign cloud for Germany
In May 2026, Thales and Google Cloud announced a strategic partnership for a sovereign cloud in Germany (according to Thales' press release). It is operated by a new German company wholly owned by Thales.
Thales operates the platform and manages the cryptographic keys. Technically, the offering is built the same way as S3NS in France; together, they form two sovereign regions in Europe. Available in preview. According to Thales and Google, general availability is planned for the end of 2026 – realistically, we expect Q1 2027.
We support companies on the way there – from classification and architecture to migration.
At a glance
A new German company wholly owned by Thales
Operator
Held by Thales
Keys
Google Cloud Dedicated
Technology
Available in preview
Availability
S3NS
Counterpart in France
Which tier for which industry?
Energy and critical infrastructure
Control systems and metering data with high protection requirements; often Data Boundary or Dedicated.
Finance
High requirements for outsourcing and control; usually Data Boundary with external keys.
Healthcare
Patient data with special protection needs; Dedicated for sensitive areas.
Public administration
Citizens' data with strict requirements; Dedicated as the goal.
Defense and security
Classified information; Air-Gapped.
Industry and SMEs
Design and production data; often public cloud with data residency in Germany, or Data Boundary.
This classification is a guide; what matters are your requirements and risks.
Approach
How you get to the right tier
Sovereignty is not a yes-or-no question but a question for each application. We start with a sovereignty assessment, assign each application to a tier and build an architecture from it that combines as much cloud as possible with as much control as necessary.
01
Sovereignty assessment
Capture applications, data, protection needs and requirements: what has to be stored where, and who may access it?
02
Tier per application
Assign each application to a sovereignty tier, with reasons and alternatives.
03
Target architecture
Define regions, key management, access controls, network and operating model.
04
Partners and contracts
Depending on the tier, bring in operators such as Thales and clarify responsibilities.
05
Migration
Move applications step by step, with tests and a fallback plan.
06
Operations and evidence
Monitoring, key and access logs and regular reviews as a managed service.
From practice: sovereign cloud in a hospital group
How a hospital group distributes its applications across Google's sovereignty tiers according to protection needs – with Google Cloud Dedicated for patient data.
Next step
Let’s get started together
In a joint workshop, we clarify your requirements and develop a concrete roadmap for implementation.
Find out in 30 minutes which sovereignty tier fits your data
- Assessment of your applications and data
- The right tier and possible partners
- Next steps
Frequently asked questions
A cloud in which data, keys and operations remain under the control of the customer or a European operator. How far that control extends depends on the tier you choose.
Three tiers: Google Cloud Data Boundary in the public cloud, Google Cloud Dedicated as separate infrastructure operated by a local partner, and Google Cloud Air-Gapped with no connection to the outside. On top of that comes the public cloud with regions in Germany.
Separate, dedicated Google Cloud infrastructure operated by an independent local partner. In France this is S3NS; in Germany it is a new German company wholly owned by Thales.
In May 2026, Thales and Google Cloud announced a partnership for a sovereign cloud in Germany. It is operated by a new German company wholly owned by Thales, which also manages the keys. Available in preview. According to Thales and Google, general availability is planned for the end of 2026 – realistically, we expect Q1 2027.
A set of controls in the public cloud that lets you define where data is stored and processed and who may access it – for example with external key management and access justifications.
Google Cloud operates regions in Frankfurt and Berlin.
Yes, to a different extent depending on the tier. Google Cloud Dedicated offers GPUs for AI applications, and Google Cloud Air-Gapped brings AI capabilities into separated environments. We clarify which models are available in the concept phase.
That depends on the protection needs of each individual application. Many companies combine several tiers. In the sovereignty assessment, we classify each application.