STACKIT is a high momentum cloud platform being built up by the Schwarz group, a large European retail group owning the Lidl and Kaufland.
The STACKIT cloud platform targets clients in the DACH region, and seems to be one of the few players who aims to offer a complete enterprise cloud solution, including workplace. For that purpose, STACKIT has established several cooperations, such as with Google for sovereign, secure workplace productivity solutions and with SAP.
The cloud platform is under heavy development and the Schwarz group seems to be very serious about the endeavour. They are also investing in an European centre for Artificial Intelligence, the Innovation Park Artificial Intelligence (IPAI) Heilbronn.
In April 2026, STACKIT was selected by the European Commission as one of four cloud providers in a €180M tender. As part of the tender process, STACKIT was officially recognized as SEAL-3 level according to the EU’s Cloud Sovereignty Framework.
Features & Services
The STACKIT platform consists of the basic set of IaaS services with a good set of database options and some services particularly interesting for Enterprise customers, such as Windows servers and Red Hat Enterprise servers. The Confidential Server and Confidential Kubernetes are also particularly relevant for high-security enterprise requirements, defence and similar scenarios.
A unique service with the STACKIT platform is STACKIT Cloud Foundry. While STACKIT does not (yet) have a serverless product as such, Cloud Foundry can be viewed as a Serverless Container product.
Developer Experience
There are several ways of working with STACKIT. In general, the developer tooling is built according to best practices, by following an API-first approach. New features are always surfaced in the API first. THe Command Line Interface, Terraform provider, SDKs and Console are relying on the API. These are typically updated soon after the API has become stable.
REST API
The STACKIT API is the basis for the CLI, the Terraform provider, the SDKs and for the Console. As several STACKIT services are in the process of being built up, several APIs are still in beta status. A documentation for all API endpoints can be found in the STACKIT API Explorer.
Command Line Interface (CLI)
The STACKIT CLI is easy to use and follows the API. It is publicly maintained on GitHub.
Terraform
The STACKIT Terraform provider feels and behaves exactly as a Terraform provider should feel and behave. It is updated frequently to surface new services and configuration options. Like with the Command Line Interface, the source code of the STACKIT Terraform provider is publicly hosted on GitHub.
SDKs
As of October 2025, STACKIT is providing two official SDKs. One for Python and one for Go. Both SDKs are maintained on GitHub.
- Python SDK: GitHub and Documentation
- Go SDK: GitHub and Documentation
Console
The STACKIT Console appears clean and uncluttered. However, navigation requires getting used to. For example, it is a bit unintuitive how to navigate from Project level up to Organization level. Also, it is not easy to get an overview over all provisioned cloud resources.
It is very likely just a matter of time until these wrinkles are resolved. The STACKIT console has the potential to be a very user friendly cloud console. It is laid out for scale and will continue to appear clean even when the STACKIT service portfolio grows.
Sovereignty Assessment
For the sovereignty assessment, we are following the EU's Cloud Sovereignty Framework. It defines 8 sovereignty objectives and makes sovereignty measurable and quantifiable.
Disclaimer: this assessment is conducted as an outside-in analysis, based on public information and, for some questions, educated guessing. The results may be factually wrong and in no way replace your own due diligence.
Overall Score
80.2 %
SEAL Level
SEAL 3
- Provider
- STACKIT
- Framework
- Initial framework from the Sovereignty assessment calculator annex (v1.0)
- Assessment date
- 7. August 2026
- Overall score
- 80.2 %
- SEAL level
- SEAL 3
SOV-1 — Strategic Sovereignty
Strategic sovereignty captures the degree to which a cloud provider (or technology actor) is anchored within the European Union/EEA legal, financial, and industrial ecosystem. It assesses ownership stability, governance influence, and alignment with EU strategic priorities.
Weight 20%
Selected answer: 4. Entirely within the EU Value 125 SEAL 4
Evidence
- Schwarz Group: STACKIT Story other 17. August 2026
Schwarz Group states STACKIT is its digital division with 'data sovereignty Made in Germany' and long-term family/foundation ownership.
Relevance: Shows ultimate control resides within German/EU parent with stable ownership, supporting entirely-within-EU assessment. - STACKIT Cloud | Schwarz Digits other 17. August 2026
Schwarz Digits official page on its STACKIT cloud offering and legal structure.
Relevance: Confirms EU legal entity control with no shareholder interests or ownership-change risk, supplier HQ in Germany, and no non-European law applying — verifying entirely EU-based governance. - STACKIT Company Profile (Official) other 17. August 2026
Official profile; STACKIT is Schwarz Digits' cloud provider, headquartered in Germany, EU data exclusivity and German legal entity Schwarz Digits Cloud GmbH & Co. KG.
Relevance: Confirms German-headquartered legal entity controlled by Schwarz Group, anchoring ultimate decision-making entirely within EU jurisdiction. - STACKIT Imprint & Legal Notice other 17. August 2026
Official legal disclosure confirming STACKIT's legal entity Schwarz Digits Cloud GmbH & Co. KG, registered in Bad Friedrichshall, Germany.
Relevance: Authoritative legal source confirming EU (German) legal entity, registered office, ownership by German GmbH, and German/Austrian jurisdiction — supporting 'entirely within EU' control.
All possible answer options (4)
- 1. Entirely outside the EU (value 0.00, SEAL 1)
- 2. Mostly outside the EU (value 41.00, SEAL 1)
- 3. Mostly within the EU (value 83.00, SEAL 3)
- 4. Entirely within the EU (value 125.00, SEAL 4) ✓
Selected answer: 5. Very unlikely Value 125 SEAL 4
Notes: Schwarz Digits, the company building STACKIT, is owned by a trust fund
Evidence
- Schwarz Group – Wikipedia other 18. August 2026
Encyclopedia overview of Schwarz Group ownership structure across family foundations.
Relevance: Details private foundation/trust ownership (Dieter Schwarz, Lidl Stiftung) making the group shielded from takeover, reinforcing STACKIT's stability. - Schwarz Group: STACKIT Story other 17. August 2026
Schwarz Group states STACKIT is its digital division with 'data sovereignty Made in Germany' and long-term family/foundation ownership.
Relevance: Confirms long-term family/foundation ownership of Schwarz Group, shielding STACKIT from external takeover, supporting Very unlikely change of control. - STACKIT Cloud | Schwarz Digits other 17. August 2026
Schwarz Digits official page on its STACKIT cloud offering and legal structure.
Relevance: Explicitly states STACKIT has 'No shareholder interests, no change of ownership' as part of Schwarz Group, directly supporting Very unlikely change of control.
All possible answer options (5)
- 1. Very likely (value 0.00, SEAL 4)
- 2. Likely takeover by or transfer to a non-EU sovereign entity (value 31.00, SEAL 4)
- 3. Somewhat likely takeover by or transfer to a non-EU sovereign entity (value 62.00, SEAL 4)
- 4. Unlikely takeover by or transfer to a non-EU sovereign entity (value 93.00, SEAL 4)
- 5. Very unlikely (value 125.00, SEAL 4) ✓
Selected answer: 4. Full influence of EU actors Value 125 SEAL 4
Evidence
- KPN & Schwarz Digits Launch European Sovereign Cloud for the Netherlands other 18. August 2026
News detailing STACKIT's Netherlands expansion roadmap, hosted in Dutch data centers and driven by EU market partners.
Relevance: Documents the provider's service-evolution roadmap driven by EU stakeholders (KPN), demonstrating EU actors' full influence on STACKIT's expansion and technology choices. - STACKIT – The sovereign cloud for companies other 18. August 2026
Official STACKIT site presenting its strategy as Europe's first hyperscaler, with seven EU data centers, open-source and GDPR-compliant roadmap.
Relevance: Official source showing STACKIT's own roadmap and ambition to shape European cloud evolution under EU control, supporting full EU influence over its technological direction.
All possible answer options (4)
- 1. No influence possible (value 0.00, SEAL 2)
- 2. Through "voice of the customer" public channels (e.g. feedback portals, online communities) (value 41.00, SEAL 2)
- 3. Governance bodies exist with EU actors participation (value 83.00, SEAL 3)
- 4. Full influence of EU actors (value 125.00, SEAL 4) ✓
Selected answer: 5. Entirely EU-based funding Value 125 SEAL 4
Evidence
- Schwarz Group – Wikipedia other 18. August 2026
Encyclopedia overview of Schwarz Group ownership structure across family foundations.
Relevance: Documents the self-financed, family/foundation ownership structure of the parent, showing funding derives from EU-internal group profits, not external capital. - Schwarz Group: STACKIT Story other 17. August 2026
Schwarz Group states STACKIT is its digital division with 'data sovereignty Made in Germany' and long-term family/foundation ownership.
Relevance: Confirms German/EU ownership and financing via Schwarz Group, evidencing EU-based capital rather than external capital. - STACKIT – The sovereign cloud for companies other 18. August 2026
Official STACKIT site presenting its strategy as Europe's first hyperscaler, with seven EU data centers, open-source and GDPR-compliant roadmap.
Relevance: Official confirmation that STACKIT, as a Schwarz Group company, is investor-independent, i.e., not reliant on external non-EU capital.
All possible answer options (5)
- 1. Almost entirely relying on non-EU funding (value 0.00, SEAL 4)
- 2. Mostly relying on non-EU funding (value 31.00, SEAL 4)
- 3. Balanced mix of EU and non-EU funding (value 62.00, SEAL 4)
- 4. Majority of funding is EU-based (value 93.00, SEAL 4)
- 5. Entirely EU-based funding (value 125.00, SEAL 4) ✓
Selected answer: 4. Majority in the EU Value 93 SEAL 4
Evidence
- Schwarz Group is betting €11bn on European digital sovereignty other 18. August 2026
Reports Schwarz Group's €11bn Lübbenau data-centre investment via Schwarz Digits/STACKIT, its largest-ever investment.
Relevance: Directly evidences EU-majority economic contribution: massive EU-based investment (€11bn) in sovereign cloud infrastructure and jobs within the EEA. - Why I am bullish on STACKIT of Schwarz Digits other 12. August 2026
Relevance: Existing evidence already assesses STACKIT's strategic sovereignty, confirming entirely EU-based funding and no external shareholder interests supporting EU-majority economic contribution.
All possible answer options (5)
- 1. Minimal (value 0.00, SEAL 4)
- 2. Some (value 31.00, SEAL 4)
- 3. Balanced EU/non-EU (value 62.00, SEAL 4)
- 4. Majority in the EU (value 93.00, SEAL 4) ✓
- 5. Fully in the EU (value 125.00, SEAL 4)
Selected answer: 2. Active participant in strategic projects Value 62 SEAL 4
Notes: Member of Gaia-X, cooperation with BSI, European Commission
Evidence
- European Commission Sovereign Cloud Tender €180M other 11. August 2026
The European Commission has awarded up to €180 million in sovereign cloud contracts to four European providers
Relevance: STACKIT is one of the selected cloud providers in the tender - Gaia-X Members Directory other 11. August 2026
Relevance: Schwarz Digits Cloud is listed in the Gaia-X members directory.
All possible answer options (3)
- 1. No clear participation (value 0.00, SEAL 4)
- 2. Active participant in strategic projects (value 62.00, SEAL 4) ✓
- 3. Strategic projects depend on contractor's involvement (value 125.00, SEAL 4)
Selected answer: Bold ambition and dedicated means Value 125 SEAL 4
Notes: Bold ambition manifested in broader strategy with Cloud, Cyber Security, Data & AI, Communication, Workspace, Bildungscampus Heilbronn, IPAI, etc.
Evidence
- Schwarz Digits - Über uns other 12. August 2026
Relevance: Describes broader strategy and portfolio of Schwarz Digits - Why I am bullish on STACKIT of Schwarz Digits other 12. August 2026
Relevance: Overview over broader strategy of Schwarz Digits parent organizations
All possible answer options (3)
- Existing Action plan (how to measure ambition? Through means linked to the goals? Relative to the size of the company?) (value 41.00, SEAL 4)
- Already measured achievement and existing dedicated governance (value 83.00, SEAL 4)
- Bold ambition and dedicated means (value 125.00, SEAL 4) ✓
Selected answer: 5. Full autonomy and continuity Value 125 SEAL 4
Evidence
- About STACKIT — Company Profile other 18. August 2026
STACKIT's official company profile detailing Schwarz Digits ownership, EU-based team, and KRITIS-grade resilient operations.
Relevance: Directly supports full autonomy/continuity: entire stack managed by EU-based team with fully sovereign, independent operations across EU data centers. - STACKIT Cloud – Schwarz Group Story other 18. August 2026
Schwarz Group narrative describing STACKIT's multi-data-center resilience, 24/7 stability operations, and digital-autonomy mission.
Relevance: Shows resilience to cut-off: data across multiple German/Austrian DCs, around-the-clock ops team, and independence from external vendors via open standards. - STACKIT Cloud | Schwarz Digits other 17. August 2026
Schwarz Digits official page on its STACKIT cloud offering and legal structure.
Relevance: Validates continuity: independently operated cloud built by Schwarz Group for its own infrastructure, ensuring autonomy even if third-party support is withdrawn.
All possible answer options (4)
- 2. Service would likely stop but with a delay to provide time for customer reaction (value 31.00, SEAL 0)
- 3. Can continue temporarily based on contractual agreement with EC (value 62.00, SEAL 2)
- 4. Ability to source alternative suppliers or internalise key functions (value 93.00, SEAL 2)
- 5. Full autonomy and continuity (value 125.00, SEAL 4) ✓
SOV-2 — Legal & Jurisdictional Sovereignty
Legal & Jurisdictional sovereignty evaluates the legal environment, exposure to foreign authority, and enforceability of rights that govern a technology provider and its services. It determines the extent to which a provider is anchored in European jurisdiction and insulated from external legal claims.
Weight 10%
Selected answer: 3. Exclusively EU law Value 167 SEAL 4
Evidence
- STACKIT – The sovereign cloud for companies other 18. August 2026
Official STACKIT site presenting its strategy as Europe's first hyperscaler, with seven EU data centers, open-source and GDPR-compliant roadmap.
Relevance: Confirms pure EU legal/regulatory framework (GDPR, EU hosting) and independence from non-EU investors/laws, supporting exclusively EU jurisdiction. - STACKIT Imprint & Legal Notice other 17. August 2026
Official legal disclosure confirming STACKIT's legal entity Schwarz Digits Cloud GmbH & Co. KG, registered in Bad Friedrichshall, Germany.
Relevance: Shows contracts/operations governed solely by German/EU law, with German court registration, directly supporting 'Exclusively EU law'.
All possible answer options (3)
- 1. Non-EU only (value 0.00, SEAL 1)
- 2. Mixed EU/non-EU (value 84.00, SEAL 1)
- 3. Exclusively EU law (value 167.00, SEAL 4) ✓
Selected answer: Verified legal immunity, non-EU laws unenforceable Value 167 SEAL 4
Notes: Schwarz Digits Cloud GmbH & Co. KG has PoPs only in the EU and is not subject to non-EU law
Evidence
- CLOUD Act: Risk for GDPR and Data Sovereignty? – STACKIT other 19. August 2026
STACKIT article explaining the US CLOUD Act and how, as a fully European provider with no US corporate ties, STACKIT is not subject to it. Covers EU-only data centers in Germany and Austria.
Relevance: Directly addresses immunity from CLOUD Act, the primary extraterritorial law. Confirms STACKIT has no US presence and no non-EU law applies. - Data Sovereignty with STACKIT — STACKIT Cloud other 19. August 2026
STACKIT's official data sovereignty page. Confirms all HQ and data centers exclusively in the EU, subject only to European and German law, protecting from CLOUD Act third-party access.
Relevance: States EU-only jurisdiction, no non-EU law applies. Core evidence for legal immunity from extraterritorial claims under the sovereignty framework. - From discount to data: Lidl owner's €11bn wager on European digital independence — fDi Intelligence other 19. August 2026
Financial Times (fDi Intelligence) article on Schwarz Digits' digital sovereignty strategy. Details a 2017 server confiscation incident and motivation against US/Chinese hyperscaler exposure.
Relevance: Independent third-party reporting confirming STACKIT's legal structure is deliberately designed to avoid extraterritorial law exposure from non-EU authorities.
All possible answer options (4)
- Mitigation clauses, exposure remains (value 41.00, SEAL 1)
- EU subsidiary with contractual protections (value 83.00, SEAL 1)
- Legal structures shielding from foreign law (value 125.00, SEAL 2)
- Verified legal immunity, non-EU laws unenforceable (value 167.00, SEAL 4) ✓
Selected answer: 5. Non-EU authorities requests to access data or systems are always rejected by the provider Value 167 SEAL 4
Notes: Non-EU law cannot be applied, as Schwarz Digits Cloud GmbH & Co. KG has no presence outside EU. Requests have no legal basis.
Evidence
- CLOUD Act: Risk for GDPR and Data Sovereignty? – STACKIT other 19. August 2026
Article how the US CLOUD Act compels US-based providers to hand over data, and how STACKIT avoids this by being a fully European provider with no US ties.
Relevance: Directly addresses the primary non-EU legal pathway (CLOUD Act) for data access. Confirms STACKIT has no US corporate presence and is not subject to extraterritorial demands. - Data Sovereignty with STACKIT — STACKIT Cloud other 19. August 2026
STACKIT's official data sovereignty page detailing EU-only jurisdiction, data centers in Germany/Austria, and protection from third-country data access.
Relevance: Official statement that exclusively EU/German law applies, preventing non-EU authorities from compelling access. Directly supports the assessment answer. - From discount to data: Lidl owner's €11bn wager on European digital independence — fDi Intelligence other 19. August 2026
FT/fDi article on Schwarz Group's motivation for sovereignty: a 2017 incident where foreign authorities confiscated servers in Germany extraterritorially.
Relevance: Independent journalism confirming the deliberate design to avoid non-EU jurisdiction. Documents the 2017 incident driving the zero non-EU presence strategy.
All possible answer options (4)
- 2. Non-EU authorities can compel access to data or systems without customers being notified, in specific cases (value 41.00, SEAL 1)
- 3. Non-EU authorities can compel access to data or systems with customers being notified in all cases (value 83.00, SEAL 1)
- 4. Non-EU authorities requests to access data or systems are disputed by the provider and eventually in some cases are accepted with customers being notified (value 125.00, SEAL 1)
- 5. Non-EU authorities requests to access data or systems are always rejected by the provider (value 167.00, SEAL 4) ✓
Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs Value 125 SEAL 3
Notes: STACKIT as a cloud platform is not itself a US-origin item "subject to ITAR/EAR," because it is a German/European service operated by Schwarz Digits Cloud GmbH & Co. KG (Bad Friedrichshall, Germany) with data centers exclusively in Germany, Austria and (via KPN) the Netherlands. However, US export controls can still attach in several indirect ways, and EU/German dual-use law applies directly.
No evidence provided for this answer.
All possible answer options (4)
- Restrictions exists towards EU citizens or international organisations (value 41.00, SEAL 1)
- Share of revenues >50% in the EU (value 83.00, SEAL 2)
- Part of the offer cannot be exposed to restrictions towards EU MSs (value 125.00, SEAL 3) ✓
- Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations (value 167.00, SEAL 4)
Selected answer: 3. Mixed within/outside the EU Value 83 SEAL 4
Notes: Open-Source products are being developed internationally. Own STACKIT-proprietary IP is fully located in the EU.
Evidence
- CLOUD Act: Risk for GDPR and Data Sovereignty? – STACKIT other 19. August 2026
STACKIT article explaining how the US CLOUD Act works and that STACKIT, as a fully European provider without US corporate ties, is immune from it.
Relevance: Directly evidences exclusive EU jurisdiction and immunity from non-EU authority (CLOUD Act), stating no non-European law applies to STACKIT. - Schwarz Group is betting €11bn on European digital sovereignty other 18. August 2026
Reports Schwarz Group's €11bn Lübbenau data-centre investment via Schwarz Digits/STACKIT, its largest-ever investment.
Relevance: Third-party evidence of structural motivation for jurisdictional immunity, documenting an actual non-EU authority confiscation of servers in Germany. - STACKIT Cloud | Schwarz Digits other 17. August 2026
Schwarz Digits official page on its STACKIT cloud offering and legal structure.
Relevance: Official source confirming exclusive EU jurisdiction and verified immunity from non-EU legal claims for STACKIT services.
All possible answer options (4)
- 2. Mostly outside the EU (value 41.00, SEAL 4)
- 3. Mixed within/outside the EU (value 83.00, SEAL 4) ✓
- 4. Mostly within the EU (value 125.00, SEAL 4)
- 5. Fully within the EU (value 167.00, SEAL 4)
Selected answer: fully under EU law Value 167 SEAL 4
Notes: STACKIT own IP is fully under EU law
No evidence provided for this answer.
All possible answer options (4)
- non-EU law, mixed non-EU countries (value 41.00, SEAL 3)
- Mixed law, some EU (value 83.00, SEAL 3)
- EU law with exceptions (value 125.00, SEAL 4)
- fully under EU law (value 167.00, SEAL 4) ✓
SOV-3 — Data & AI Sovereignty
Data & AI sovereignty focuses on the protection, control, and independence of data assets and AI services within the EU/EEA. It addresses how data is secured, where it is processed, and the degree of autonomy customers retain over AI capabilities.
Weight 10%
Selected answer: 4. Customer primary control but provider can read the data or some of the data Value 150 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- 2. Primarily the provider but not exclusively (value 50.00, SEAL 1)
- 3. Shared - provider has override keys (value 100.00, SEAL 2)
- 4. Customer primary control but provider can read the data or some of the data (value 150.00, SEAL 3) ✓
- 5. Customer exclusive control - provider can not read the data (value 200.00, SEAL 4)
Selected answer: 5. Real-time customer oversight and independent auditability Value 200 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Basic logs incomplete (missing date; missing user; missing type of access; missing means of access etc.) (value 50.00, SEAL 1)
- 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) (value 100.00, SEAL 2)
- 4. Full customer controlled visibility of log access but not in real time (value 150.00, SEAL 3)
- 5. Real-time customer oversight and independent auditability (value 200.00, SEAL 4) ✓
Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3
Notes: STACKIT is under GDPR and therefore has the relevant mechanisms in place.
No evidence provided for this answer.
All possible answer options (4)
- 2. Manual confirmation only (value 50.00, SEAL 1)
- 3. Internal validation based on policies - no proof of validation left (value 100.00, SEAL 1)
- 4. Deletion is technically verified with access logs (value 150.00, SEAL 3) ✓
- 5. Yes, irreversible deletion is systematically enforced and independently verified (value 200.00, SEAL 4)
Selected answer: 5. All data exclusively in the EU with no third-country fallback Value 200 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Data partly in the EU, significant reliance on third countries and limited control (value 50.00, SEAL 0)
- 3. Data mainly in the EU, some third-country use with standard safeguards (value 100.00, SEAL 1)
- 4. Data in the EU by default, tightly controlled exceptions (value 150.00, SEAL 1)
- 5. All data exclusively in the EU with no third-country fallback (value 200.00, SEAL 4) ✓
Selected answer: EU-led AI, foreign accelerators Value 150 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- Mostly non-EU dependencies: Licensed AI, chip dependency (value 50.00, SEAL 2)
- Mixed Control with alternatives: Auditable or open source AI, foreign chips (value 100.00, SEAL 2)
- EU-led AI, foreign accelerators (value 150.00, SEAL 3) ✓
- EU-origin models and chips - no dependencies from outside EU (value 200.00, SEAL 4)
SOV-4 — Operational Sovereignty
Operational sovereignty measures the practical ability of EU actors to run, support, and evolve a technology independently of foreign control. It focuses on continuity of operations, skill availability, and resilience against external dependencies.
Weight 15%
Selected answer: 5. Solution already deployed on sovereign infrastructure Value 167 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Data export and workload portability is provided on a "best-effort" basis (value 41.00, SEAL 1)
- 3. Standard documented methods for data export are available (value 83.00, SEAL 4)
- 4. Formal migration services are available to assist with moving data and workloads (value 125.00, SEAL 4)
- 5. Solution already deployed on sovereign infrastructure (value 167.00, SEAL 4) ✓
Selected answer: 5. The entire technology stack is managed and supported by a fully EU-based team Value 167 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Operational services are partially sourced from within the EU (value 41.00, SEAL 1)
- 3. Operational responsibilities are balanced between EU and non-EU teams (value 83.00, SEAL 3)
- 4. Operational services are predominantly delivered by EU-based teams (value 125.00, SEAL 3)
- 5. The entire technology stack is managed and supported by a fully EU-based team (value 167.00, SEAL 4) ✓
Selected answer: All EU staff Value 125 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- Mixed, majority outside EU (value 41.00, SEAL 1)
- Majority EU, escalation abroad (value 83.00, SEAL 3)
- All EU staff (value 125.00, SEAL 3) ✓
- 100% EU staff + clearance (value 167.00, SEAL 4)
Selected answer: 4. All support staff are located within the EU Value 125 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- 2. The team is mixed but the majority of support staff reside outside the EU (value 41.00, SEAL 2)
- 3. The majority of support staff are in the EU but escalations are handled by non-EU teams (value 83.00, SEAL 3)
- 4. All support staff are located within the EU (value 125.00, SEAL 3) ✓
- 5. All support staff are located within the EU and hold relevant security clearances (value 167.00, SEAL 4)
Selected answer: 5. EU-only end-to-end - Content, metadata, and backups/replicas are stored in the EU and privileged administration/support access is restricted to EU-based staff under EU jurisdiction Value 167 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. EU optional, not enforced - EU storage is available as an option, but it is not enforced (value 41.00, SEAL 2)
- 3. EU primary with non-EU fallback - Stored/managed in the EU by default, but some storage/replication/access outside the EU may occur (e.g., disaster recovery/support) (value 83.00, SEAL 4)
- 4. EU-only primary repositories - All primary documentation and knowledge repositories are stored in the EU (no routine non-EU storage/processing) (value 125.00, SEAL 4)
- 5. EU-only end-to-end - Content, metadata, and backups/replicas are stored in the EU and privileged administration/support access is restricted to EU-based staff under EU jurisdiction (value 167.00, SEAL 4) ✓
Selected answer: 5. Full autonomy and continuity Value 167 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Service would likely stop but with a delay to provide time for customer reaction (value 41.00, SEAL 2)
- 3. Can continue temporarily based on contractual agreement with EC (value 83.00, SEAL 3)
- 4. Ability to source alternative suppliers or internalise key functions (value 125.00, SEAL 3)
- 5. Full autonomy and continuity (value 167.00, SEAL 4) ✓
SOV-5 — Supply Chain Sovereignty
Supply chain sovereignty evaluates the geographic origin, transparency, and resilience of the technology supply chain, focusing on the extent to which critical components and processes remain under EU control or exposed to non-EU dependencies.
Weight 10%
Selected answer: Transparent with exceptions Value 71 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- Partial disclosure (value 35.00, SEAL 1)
- Transparent with exceptions (value 71.00, SEAL 3) ✓
- Full transparency (value 107.00, SEAL 3)
- EU-certified provenance (value 143.00, SEAL 4)
Selected answer: Mixed sourcing, EU audit rights Value 71 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- Foreign origin, partial disclosure (value 35.00, SEAL 1)
- Mixed sourcing, EU audit rights (value 71.00, SEAL 3) ✓
- Build by EU Teams, on the basis of a foreign code (value 107.00, SEAL 3)
- Exclusive designed and build by EU Teams (value 143.00, SEAL 4)
Selected answer: Transparent with exceptions Value 71 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- Partial disclosure (value 35.00, SEAL 4)
- Transparent with exceptions (value 71.00, SEAL 4) ✓
- Full transparency (value 107.00, SEAL 4)
- EU-certified provenance (value 143.00, SEAL 4)
Selected answer: 3. Core and essential parts of the software are designed and maintained by EU teams Value 71 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- 2. Software is of foreign origin with partial disclosure on its development (value 35.00, SEAL 2)
- 3. Core and essential parts of the software are designed and maintained by EU teams (value 71.00, SEAL 3) ✓
- 4. A large majority of the software is designed and maintained by EU teams (value 107.00, SEAL 3)
- 5. The software is exclusively designed and maintained by EU teams (value 143.00, SEAL 4)
Selected answer: 3. Non-EU control, EU execution - Execution is performed by EU teams, but pipeline administration and/or final release approvals (incl. signing) are under non-EU jurisdiction Value 71 SEAL 3
Notes: Mixed, but core open source products are controlled outside of EU jurisdiction
No evidence provided for this answer.
All possible answer options (4)
- 2. EU control, non-EU execution - Execution is performed by non-EU teams, but pipeline administration and final release approvals are under EU jurisdiction (value 35.00, SEAL 1)
- 3. Non-EU control, EU execution - Execution is performed by EU teams, but pipeline administration and/or final release approvals (incl. signing) are under non-EU jurisdiction (value 71.00, SEAL 3) ✓
- 4. EU control & execution - Build/release/deployment is executed by EU teams and governed from within the EU (pipeline administration, signing, approvals) (value 107.00, SEAL 3)
- 5. EU control and EU policy gates - As (4), plus EU-based compliance/security gates enforced in the pipeline (e.g., signing under your control, vulnerability checks, segregation of duties, auditable approvals) (value 143.00, SEAL 4)
Selected answer: No depedency on non-EU vendor or facility Value 143 SEAL 4
Notes: No dependency on non-EU vendors for critical systems. Non-EU players only when there are alternatives
No evidence provided for this answer.
All possible answer options (4)
- Mostly non-EU vendors or facilities involved in critical services, non documented (value 35.00, SEAL 1)
- Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented (value 71.00, SEAL 2)
- Few non-EU vendors or facilities involved in non-critical services, documented (value 107.00, SEAL 3)
- No depedency on non-EU vendor or facility (value 143.00, SEAL 4) ✓
Selected answer: All suppliers and subcontractors can be audited Value 143 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- Some suppliers and subcontractors can be audited (value 35.00, SEAL 1)
- Critical suppliers and subcontractors can be audited (value 71.00, SEAL 2)
- Most suppliers and subcontractors can be audited (value 107.00, SEAL 3)
- All suppliers and subcontractors can be audited (value 143.00, SEAL 4) ✓
SOV-6 — Technology Sovereignty
Technology sovereignty evaluates the degree of openness, transparency, and independence in the underlying technological stack, ensuring EU actors can interoperate, audit, and evolve solutions without lock-in to foreign proprietary systems.
Weight 15%
Selected answer: 5. Open-by-default with portability - All critical functions are accessible via open, well-documented, non-proprietary APIs and standard formats, with published specifications and minimal vendor-specific dependencies enabling easy third-party integration Value 200 SEAL 4
Notes: STACKIT Cloud is built on Open Standards by design and follows an API-first approach.
Evidence
- STACKIT API User Guide other 12. August 2026
All possible answer options (4)
- 2. Restricted proprietary APIs - Some vendor APIs exist, but they are limited/restricted (access, scope, licensing) and interoperability remains vendor-controlled (value 50.00, SEAL 1)
- 3. Mixed (partial openness) - Key interfaces are documented and partly standards-based, but important functions or data formats remain proprietary/vendor-specific (value 100.00, SEAL 2)
- 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation (value 150.00, SEAL 3)
- 5. Open-by-default with portability - All critical functions are accessible via open, well-documented, non-proprietary APIs and standard formats, with published specifications and minimal vendor-specific dependencies enabling easy third-party integration (value 200.00, SEAL 4) ✓
Selected answer: 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions Value 150 SEAL 3
Notes: Exceptions are if no suitable open standards exist
No evidence provided for this answer.
All possible answer options (4)
- 2. Ad hoc use - Open standards are used inconsistently on a case-by-case basis, without documented rationale or governance (value 50.00, SEAL 0)
- 3. Partial core adoption - Open standards are used and documented for some core services, while other core services remain proprietary/vendor-specific (value 100.00, SEAL 2)
- 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions (value 150.00, SEAL 3) ✓
- 5. Policy for all core services - A formal policy mandates and documents open standards for all core services (value 200.00, SEAL 4)
Selected answer: 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover Value 100 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- 2. Source code is available for review but modification and handover rights are under very strict conditions (value 50.00, SEAL 2)
- 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover (value 100.00, SEAL 3) ✓
- 4. The software is open source with significant EU contributions but governance is restricted and handover is possible (value 150.00, SEAL 4)
- 5. Fully open-source software is governed by an independent or EU-based entity, granting full rights to audit, modify, redistribute, and seamlessly transfer stewardship (value 200.00, SEAL 4)
Selected answer: Some public insight exists (all) Value 100 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- Insight accessible during audits (value 50.00, SEAL 2)
- Some public insight exists (all) (value 100.00, SEAL 3) ✓
- Large corpus of public insight exists (all) (value 150.00, SEAL 3)
- Customers can contribute to adapt and enhance the service (value 200.00, SEAL 4)
Selected answer: Co-designed or integrated in EU Value 100 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- EU-hosted, foreign stack (value 50.00, SEAL 3)
- Co-designed or integrated in EU (value 100.00, SEAL 3) ✓
- EU processor IP, non-EU fabs (value 150.00, SEAL 3)
- EU design + EU fab + EU ops (value 200.00, SEAL 4)
SOV-7 — Security & Compliance Sovereignty
Security & Compliance sovereignty measures the extent to which security operations, compliance obligations, and resilience measures are controlled within the EU , ensuring independence from foreign jurisdictions and long-term operational assurance.
Weight 15%
Selected answer: ELA3 Value 107 SEAL 3
No evidence provided for this answer.
All possible answer options (4)
- ELA1 (value 35.00, SEAL 1)
- EAL2 (value 71.00, SEAL 2)
- ELA3 (value 107.00, SEAL 3) ✓
- EAL4-5 (value 143.00, SEAL 4)
Selected answer: 5. Fully compliant to all well-know EU regulations (verified compliance, independently audited) Value 143 SEAL 4
Notes: Schwarz Digits is a EU based company, this is mandatory by nature
No evidence provided for this answer.
All possible answer options (4)
- 2. Limited compliance to some well-known EU Regulations (basic practices exist but informal, incomplete, or non-systematic) (value 35.00, SEAL 4)
- 3. Moderate compliance to some well-know EU Regulations (controls exist but gaps remain; compliance not fully demonstrated) (value 71.00, SEAL 4)
- 4. Partial compliance to most of the well-known EU Regulations (requirements implemented and operational with minor exceptions) (value 107.00, SEAL 4)
- 5. Fully compliant to all well-know EU regulations (verified compliance, independently audited) (value 143.00, SEAL 4) ✓
Selected answer: 5. The full incident lifecycle is handled by EU-based teams with active participation in ENISA's information sharing frameworks. Threat intelligence and incident data are gathered worldwide Value 143 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. A hybrid model is used with SOC functions split between EU and non-EU locations (value 35.00, SEAL 1)
- 3. The primary SOC is in the EU but incidents may be escalated to non-EU teams (value 71.00, SEAL 1)
- 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources (value 107.00, SEAL 3)
- 5. The full incident lifecycle is handled by EU-based teams with active participation in ENISA's information sharing frameworks. Threat intelligence and incident data are gathered worldwide (value 143.00, SEAL 4) ✓
Selected answer: 5. Customers have full access to immutable tamper-proof logs stored exclusively within the EU Value 143 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Customers receive periodic reports based on security logs (value 35.00, SEAL 1)
- 3. Customers have access to a basic portal for monitoring (value 71.00, SEAL 1)
- 4. Customers have full direct access to their security monitoring and logs which are stored in the EU (value 107.00, SEAL 3)
- 5. Customers have full access to immutable tamper-proof logs stored exclusively within the EU (value 143.00, SEAL 4) ✓
Selected answer: 5. Full compliance - full EU-compliant breach disclosure with real-time data sharing to EU CSIRTs with audit-backed processes, proactive vulnerability disclosure and threat intel sharing; proven readiness for investigations Value 143 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Limited compliance - reporting is reactive with limited transparency and unguaranteed timelines; CSIRT cooperation possible on best-effort basis (value 35.00, SEAL 1)
- 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time (value 71.00, SEAL 2)
- 4. Partial compliance - there is a monitored reporting flow with internal SLAs equal or below regulatory maximums; contractually prepared to support EU-directed investigations; data sharing with EU CSIRTs available but not in real-time (value 107.00, SEAL 3)
- 5. Full compliance - full EU-compliant breach disclosure with real-time data sharing to EU CSIRTs with audit-backed processes, proactive vulnerability disclosure and threat intel sharing; proven readiness for investigations (value 143.00, SEAL 4) ✓
Selected answer: 4. High Autonomy - security patches can be deployed independently by the customer, without customers' checks Value 107 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- 2. Limited Autonomy - security patches are deployed according to vendor schedules; basic testing is possible (value 35.00, SEAL 1)
- 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching (value 71.00, SEAL 4)
- 4. High Autonomy - security patches can be deployed independently by the customer, without customers' checks (value 107.00, SEAL 4) ✓
- 5. Full Autonomy - security patches can be deployed independently by the customer, with customers' checks (value 143.00, SEAL 4)
No answer selected for this question.
All possible answer options (4)
- 2. Limited access to independent entities to the data provided by the vendor (value 35.00, SEAL 1)
- 3. Partial control by independent entities on the data provided by the vendor (value 71.00, SEAL 1)
- 4. High control by independent entities to request data from the vendor (value 107.00, SEAL 1)
- 5. Full control by any idependent entity to perform security and compliance audits (value 143.00, SEAL 4)
SOV-8 — Environmental Sustainability
Environmental sustainability assesses autonomy and resilience of cloud services over the long term in relation to energy usage, dependency and raw material scarcity.
Weight 5%
Selected answer: PUE < 1.5 + roadmap Value 125 SEAL 4
No evidence provided for this answer.
All possible answer options (5)
- PUE > 0 (value 0.00, SEAL 1)
- PUE < 3 (value 62.00, SEAL 1)
- PUE < 1.5 + roadmap (value 125.00, SEAL 4) ✓
- PUE < 1.3 (value 187.00, SEAL 4)
- PUE < 1.2 EU verified (value 250.00, SEAL 4)
Selected answer: Documented program Value 125 SEAL 3
No evidence provided for this answer.
All possible answer options (5)
- No policy (value 0.00, SEAL 0)
- Circular economy EU-aligned (value 62.00, SEAL 0)
- Documented program (value 125.00, SEAL 3) ✓
- Circular economy EU-aligned (value 187.00, SEAL 4)
- EU-certified lifecycle (value 250.00, SEAL 4)
Selected answer: Detailed EU methodology Value 187 SEAL 3
No evidence provided for this answer.
All possible answer options (5)
- No reporting (value 0.00, SEAL 1)
- Detailed EU methodology (value 62.00, SEAL 1)
- Annual report (value 125.00, SEAL 2)
- Detailed EU methodology (value 187.00, SEAL 3) ✓
- EU-audited reporting (value 250.00, SEAL 4)
Selected answer: Only EU energy supplies Value 187 SEAL 4
No evidence provided for this answer.
All possible answer options (4)
- Only EU energy supplies (value 62.00, SEAL 4)
- Mix of EU and non-EU supplies (value 125.00, SEAL 4)
- Only EU energy supplies (value 187.00, SEAL 4) ✓
- Only green EU energy supplies (value 250.00, SEAL 4)
Data Centres
STACKIT is powered by 3 data centres at the moment (as of 23.03.2025). Two of them are in Germany and one is located in Austria:
- DC 01 Neckarsulm, Germany
- DC 08 Ellhofen, Germany
- DC 10 Ostermiething, Austria
For an overview over data centres and their locations, check the Data Centres Map.
By adding the Ostermiething data centre into the mix, the BSI recommendation of at least 200 km distance between geo-redundant data centre locations can be met (distance between Neckarsulm and Ostermiething is 293 km).
Environmental Policy
STACKIT does not have a public environmental policy. The PUE (Power Usage Effectiveness) values of the 3 data centres are 1.5, 1.3 and 1.2, which is slightly below the industry average of 1.55.
Certifications
Security and data protection of the STACKIT cloud service is certified by the certificates that are typically relevant in Germany: ISO/IEC 27001 and C5. STACKIT also obtained a SOC 2 certification.
A full list of certificates and STACKIT Cloud Certifications.
Conclusion
The cloud service portfolio of STACKIT consists of a range of IaaS services. With their velocity, it is likely that more services will be added soon. The same goes for documentation and other learning material (e.g. webcasts) that seem to be in the making, but not there yet.
STACKIT is a European Cloud platform player to keep an eye on. I have high expectations because I think many ingredients are coming together, as I wrote about here:
