So Sovereign Cloud SA: international access and transfer
This page provides the information required by Regulation (EU) 2023/2854 (Data Act), Article 28(1)(a) and (b) for the data processing services of So Sovereign Cloud SA (CH).
(a) Jurisdiction of the ICT infrastructure
Scroll the table sideways for all columns.
| Zone | Location | Legal entity | Data-centre operator | Services |
|---|---|---|---|---|
| ch-lmn-1 | Geneva, CH | So Sovereign Cloud SA (CH) | Lac Léman Datacentre SA (CH) | compute, object-storage, kubernetes |
| ch-uet-1 | Zurich, CH | So Sovereign Cloud SA (CH) | Uetliberg Rechenzentrum AG (CH) | compute, object-storage |
| de-mai-1 | Frankfurt, DE | So Sovereign Cloud SA (CH) | Mainhattan Colocation GmbH (DE) | compute, object-storage |
(b) Measures against international governmental access
Your data stays in the zone you pick, run by Swiss and EU companies only. Nobody here answers to a foreign subpoena, and we have the signed ledger to prove it.
Technical
- Encryption at rest for block and object storage, keys held in-zone
- Customer-provided keys (SSE-C) for object storage
- Administrative access via in-zone bastions with hardware-key MFA and session logging
Organisational
- Every authority request is reviewed by Legal; requests without a valid basis under Swiss or EU law are rejected
- Staff with production access are employed by EU/Swiss entities
- Annual external audit of access controls
Contractual
- DPA commits to challenge, minimise and notify on third-country requests (Data Act Art. 32)
- Subprocessors bound by equivalent obligations and 30-day change notice