Network sovereignty for companies
Trusted Advisor for IT & Telecommunications Sourcing
Strategically enforce data control, EU compliance & secure connectivity
Network sovereignty for companies
A perspective from independent IT & security consulting
A single contract with the wrong provider can be enough: Data that is physically located in Europe is still subject to US law. Those who do not actively manage network sovereignty relinquish control over their own infrastructure.
In a nutshell:
- The US CLOUD Act allows US authorities to access data from US providers worldwide, regardless of the physical storage location
- GDPR, NIS-2, DORA and the AI Act increase the pressure: European companies must be able to demonstrate data sovereignty in a structured manner
- 75 percent of companies outside the USA will introduce active digital sovereignty strategies by 2030, according to Gartner
The solution:
Sovereign connectivity via EU-controlled network infrastructure, encrypted transmission paths with customer-managed keys and contracts with EU legal personality create the basis for genuine network sovereignty.
Read on to find out how companies can implement network sovereignty structurally and build the right architecture with SAVECALL.
Explained by experts:
Why network sovereignty needs to be on the agenda now
European companies are facing a structural challenge: the dominant cloud infrastructure belongs to US providers. And with the US CLOUD Act, US authorities can request data from these providers, regardless of where the data is physically stored. This applies to US companies themselves, but also to all providers with a US parent company, US subsidiaries or a legal presence in the US.
As a result, data stored on servers in Frankfurt or Amsterdam is not automatically protected from access by US authorities. Those who do not actively address this have a sovereignty gap in their own infrastructure.
At the same time, the regulatory framework is increasing the pressure considerably. GDPR, NIS-2, DORA, the AI Act and country-specific requirements such as Germany’s C5 certification or France’s SecNumCloud are forcing companies to no longer just claim data sovereignty, but to provide structured proof of it. This means that security and compliance are no longer internal IT issues, but management board topics with personal liability relevance.
Where the sovereignty gaps arise
The three critical levels
Network sovereignty is not a binary yes-no concept. It arises or is absent on several levels simultaneously.
Data in transit: The underestimated attack surface
While the debate often revolves around data storage, one critical level often goes unnoticed: Data in transit between locations, data centers and cloud environments. If you have no control over the network path, you don’t know which jurisdictions your data is traveling through. And those who do not use end-to-end encryption with customer-managed keys have no guarantee that third parties will not gain access
Treaty level: EU legal personality as a basic requirement
A contract with a non-European parent company is not sufficient. The decisive factor is whether the contract is concluded with an EU legal entity, whether EU law applies as the applicable law and whether the provider’s Binding Corporate Rules guarantee GDPR compliance regardless of the location of the operating teams.
Operations: Who actually has access?
Even if data remains in the EU and contracts are governed by EU law: If operating teams outside the EU have access to infrastructure, monitoring systems or support functions, operational sovereignty gaps arise. Strict compliance requirements explicitly require EU-exclusive operating models.
The architecture of superior connectivity
Network sovereignty at infrastructure level can be mapped in four specific layers.
Path control: data remains in the EU
At Layer 1 level, dedicated optical wavelengths (Wave) enable physically isolated connections via dedicated fiber optic infrastructure that remains entirely within the EU. No public Internet, no transit through third countries, no shared infrastructure. The network path is deterministic and auditable.
At Layer 2 level, intelligent path control functions (Smart Path) allow the dynamic definition of EU-exclusive routes for Ethernet connections. Companies can define that no failover takes place outside the EU jurisdiction.
Encryption: Keys managed by the customer
Sovereign encryption does not mean that the provider encrypts. It means that the customer holds and manages the cryptographic keys themselves. No third party, including the network provider, can access the data without the active involvement of the customer. In addition, quantum-safe options are already being used productively today, which will also withstand future attack vectors by quantum computers.
Sovereign cloud connection
Connecting to European sovereign cloud providers such as Gaia-X-compatible platforms, T-Systems Open Telekom Cloud or OVHcloud requires dedicated connectivity that remains entirely within European jurisdictions. The path from corporate sites to sovereign cloud environments must not include jurisdictional changes.
Contract structure: EU law as standard, not as an option
The following applies to each of these connectivity elements: The contract must be concluded with an EU legal entity. The applicable law must be EU law. And the provider’s Binding Corporate Rules must guarantee GDPR compliance regardless of where operating teams are active.
The spectrum of sovereignty
Which solution suits which requirements
Not every company needs the same level of sovereignty. The right approach depends on the industry, regulatory framework and risk appetite.
| Requirement | Technology | Sovereignty level |
| Basic EU compliance | SD-WAN, IP VPN, Internet Access | Medium |
| Increased control and flexibility | Ethernet On Demand with Smart Path | High |
| Maximum sovereignty | Dedicated wavelength (wave) with encryption | Very high |
For companies subject to DORA, operators of critical infrastructure and public authorities, the upper end of the spectrum is not an option, but a regulatory requirement.
Network sovereignty and compliance: what NIS-2 and DORA actually require
NIS-2 explicitly requires affected companies to take measures to secure the supply chain, access control and network segmentation. DORA requires financial institutions to prove that critical ICT service providers and their subcontractors comply with data protection requirements. Both sets of regulations make it clear that it is not enough to be compliant yourself. The entire connectivity chain must be demonstrably sovereign.
Anyone who still has connectivity contracts with US parent companies, operates encryption via provider-managed keys or cannot provide proof of EU-exclusive network paths has a concrete compliance gap.
Why network sovereignty is an infrastructure decision, not a legal department task
Network sovereignty is treated as a legal issue in many companies: Contract review, GDPR documentation, DPIAs. This falls short. The contract does not decide whether data actually leaves the EU. It is the network architecture that decides.
A company that contracts with the right provider under EU law, but transports data via public Internet paths with provider-managed keys, does not have a sovereign infrastructure. True network sovereignty means: path control on layer 1 or 2, customer-side key management, EU-exclusive operating models and contract structures that legally secure all of this.
Zero exposure as a goal: what sovereign connectivity achieves structurally
Those who understand network sovereignty as an infrastructure principle and not as a compliance checkbox create a foundation that can do both: fulfill regulatory requirements and remain operationally efficient. This is not a theoretical ideal. It is the reality for European companies that want to remain capable of acting in 2026.
The solution
Sovereign infrastructure as a strategic advantage
Do you want to set up your network connectivity with confidence and meet compliance requirements from NIS-2, DORA and GDPR in a structured manner? SAVECALL supports companies in the evaluation, selection and implementation of sovereign connectivity solutions, from dedicated EU paths to Quantum-Safe Encryption and DORA-compliant contract structures. Get in touch with us. Together, we will analyze where your sovereignty gaps lie and what makes sense for your infrastructure today and in the long term.
Written by
Frank Frommknecht
Key Account Consultant, SAVECALL
Has been supporting companies for over 20 years in selecting and optimizing their connectivity solutions. His focus: making complex telecommunications understandable from the customer’s perspective and finding the right strategic solution.
Why
Telecom & IT sourcing. Worldwide. Carrier-independent.
Selection & operation of worldwide connectivity & cloud infrastructure. Without vendor risk & unnecessary costs.
- 80+ carriers worldwide
- One point of contact
- One SLA
- One portal: mySAVECALL
- Min. 20% savings
25+
years of experience
40+
Employees
80+
Partner
1400+ Clients
Sources & further reading
- SAVECALL Security – vendor-independent advice on Cyber Security, Dedicated Cloud Access, SASE and Hosting
- Managed Security Service Providers in Germany – a structured selection
- Mastering Shadow AI with SASE – security and transparency for Gen-AI in the company
- NIS2 and telecom infrastructure – obligations, deadlines and implementation
Frequently Asked Questions
Frequently asked questions about network sovereignty at SAVECALL
Network sovereignty means a company retains full control over the path, encryption and legal framework of its data transmission. It is not a binary yes-no concept; it arises or is absent on several levels at once: in data transit between locations, in contractual arrangements with providers, and in operational access to infrastructure and support. If any one of these levels is missing, a real sovereignty gap emerges across the whole company. Only the interplay of all three closes this gap effectively.
The US CLOUD Act allows US authorities to access data from US providers worldwide, regardless of physical storage location. This also applies to providers with a US parent company, US subsidiaries or a legal presence in the US. Data stored on servers in Frankfurt or Amsterdam is therefore not automatically protected from access by US authorities unless the contract, encryption and operating model are also designed to be EU-exclusive.
First, data in transit: if you don’t control the network path, you don’t know which jurisdictions your data travels through. Second, the contract level: what matters is an EU legal entity as the contracting party and EU law as the applicable law. Third, operations: if teams outside the EU have access to infrastructure or support, operational sovereignty gaps arise even when data and contract formally remain within the EU. All three levels together form the complete sovereignty chain.
At Layer 1, dedicated optical wavelengths enable physically isolated connections via dedicated fiber infrastructure that stays entirely within the EU. At Layer 2, Smart Path functions allow the dynamic definition of EU-exclusive Ethernet routes with no failover outside EU jurisdiction. This is complemented by customer-managed encryption keys, quantum-safe options already in productive use, and dedicated connections to European sovereign cloud providers such as Gaia-X-compatible platforms.
NIS-2 explicitly requires affected companies to secure the supply chain, control access and segment networks. DORA requires financial institutions to prove that critical ICT service providers and their subcontractors meet data protection requirements. Both frameworks make clear that being compliant yourself is not enough; the entire connectivity chain must be demonstrably sovereign, including every network and cloud provider along the chain. Ignoring this proof obligation risks concrete regulatory consequences.
SAVECALL supports companies in evaluating, selecting and implementing sovereign connectivity solutions, from dedicated EU paths to quantum-safe encryption and DORA-compliant contract structures. As a vendor-independent advisor, SAVECALL analyzes together with the customer where concrete sovereignty gaps exist and which architecture makes sense for their infrastructure today and in the long term, rather than looking at individual topics in isolation without an overall view.
Articles that may also interest you
Trusted Advisor for IT & Telecommunications Sourcing
What drives you forward – & what drives
Book a free expert consultation
ONE Contact. ALL Carriers.
+FAQ
You ask.
