insights! episode #37: European cloud alternatives for better data sovereignty

The Foreign Intelligence Surveillance Act obliges American corporations such as Amazon, Google and others to hand over data at the point of entry to the United States Foreign Intelligence Surveillance Court (FISC). This law applies to all non-US citizens and those without a residence permit in the US. Because of our data security requirements, we therefore looked for a European alternative. Managed service expert Marc Achsnich explains how we implemented the selection of the right cloud service provider.

An important advantage of our previous cloud provider Amazon is the many years of experience managing Kubernetes clusters. Since data sovereignty matters to us, switching to a preferably European and therefore GDPR-compliant provider was important. Due to its European headquarters and its GDPR compliance as the new operations provider, our choice fell on the France-based OVH Cloud. This is the largest European data centre, providing security measures such as network redundancies, data protection with its own DDoS department for defending against attacks. Several security measures to protect data are in place, such as an application firewall, a server firewall, components within the image pipeline to check for vulnerabilities, and a scoreboard for monitoring libraries and vulnerabilities. There are also web application firewalls to protect data from unauthorised access.

Before we chose OVH Cloud, we compared several cloud providers. Among others were Stacked, Scale-Up Technologies, Telekom, but also NetCologne. Costs for these services range from free through 200 euros up to an enterprise contract. Telekom is a popular provider but can be very expensive, while Cloudflare is a cost-effective alternative. Due to advanced technical features like the Kubernetes cluster and cost efficiency, we ultimately chose OVH Cloud.