Your data in Europe, under European law, run by a European company.

"Sovereign cloud" is used for very different things. For some providers it means only that servers are located in Europe. A useful definition answers four questions, and all four have to hold.

basis.no meets all four layers by how the company is owned and built, not through a special product tier or a contractual add-on.

Sovereignty is a result of concrete choices about ownership, people, locations and technology. These are ours.

• Ownership – 100% Norwegian-owned. No foreign parent company, no US subsidiaries.
• People – all operations staff are based in Norway or the EU, and there is no administrative access from outside the EEA. Administrative access uses named accounts and hardware security keys. Police-certificate requirements can be agreed for your service.
• Access control – all administrative personnel authenticate with a hardware security key (YubiKey).
• Supply chain – no subcontractors other than the European-owned data centre providers that house our equipment. The servers, network and platform in those facilities are ours.
• Isolated tenants – every customer gets its own tenant, separated from other customers, with ready-to-use security policies.
• Open-source platform – the platform is built on open-source components, with no dependency on any hyperscaler's services.

You choose whether your environment runs in Norway or Germany. Production data and backups stay in the location you choose.

Sovereignty is also about documenting control to your auditors, your board and your supervisory authority. This is what we can document.

• GDPR – Norway is part of the EEA, so GDPR applies in full. Hosting location, administrative access and any external services are documented for your setup. Any international transfers must be assessed for that setup.
• ISAE 3402 that covers your services – the report covers the operations we perform for you, not only the provider's own internal controls. Your auditor can rely on it.
• DORA – for financial entities, we support the ICT third-party requirements: contractual terms, audit rights, exit plans and incident reporting.
• NIS2 – our operations follow the NIS2 requirements for risk management, incident handling and supply-chain security, which helps you meet your own obligations.

More detail on our controls is available on the Compliance and Security page.

Public cloud platforms are good at many things. This is an honest comparison of where the two models differ, so you can decide what matters for your workloads.

Where a hyperscaler is the stronger choice:

• Global reach – if you need data centres on several continents
• Service catalogue – if you build on hundreds of proprietary managed services
• Burst scale – if your capacity needs swing by orders of magnitude from hour to hour

Many of our customers use both: business-critical systems and sensitive data with basis.no, and other workloads in the public cloud.

Every basis.no service runs on the same platform, under the same ownership and controls described on this page.

Sovereignty is the foundation. On top of it, agree which of these operational services are included in your basis.no agreement. The exact scope depends on the product and service schedule.

Use these questions to test any sovereignty claim, including ours. The answers should be specific and documented.

1. Who ultimately owns the company?Ours: 100% Norwegian owners, no US parent.
2. Can a non-European authority compel you to hand over our data?Ours: a Norwegian-owned provider without a US parent. Review applicable jurisdictions and any connected providers for your service.
3. Where are production data, backups and logs stored?Ours: in Norway or Germany, as you choose.
4. Who has administrative access, and from which countries?Ours: our own security-vetted staff in Norway and the EU, using hardware security keys.
5. Which subcontractors are involved?Ours: only the European-owned data centre providers that house our equipment.
6. Does your audit report cover the services you run for us?Ours: yes. ISAE 3402 Type 2, audited annually by BDO.
7. How do we leave if we need to?Ours: you own your systems and data, and the platform builds on open standards.

Norway is not in the EU. Is this an EU sovereign cloud?

Norway is part of the European Economic Area (EEA). GDPR and other EU rules on data protection and digital services apply in Norway as they do in the EU. Customers who need their data inside an EU member state can choose our data centre in Hamburg, Germany.

Doesn't the EU–US Data Privacy Framework solve this?

The Data Privacy Framework provides a legal basis for transferring personal data to certified US companies. It does not change the CLOUD Act or FISA 702, and it remains subject to legal challenge, as its two predecessors were struck down. A Norwegian-owned hosting platform reduces dependence on a US provider; connected services and any data transfers still need to be assessed.

Is the sovereign platform only for SAP?

No. We run SAP, Kubernetes, integrations, Odoo and AI workloads on the same platform, and SAP customers can also host non-SAP applications in their own tenant.

Can we choose between Norway and Germany?

Yes. You choose the location when the environment is set up, and production data and backups stay there.

Can we combine basis.no with public cloud?

Yes. Many customers keep business-critical systems and sensitive data with us and run other workloads in the public cloud. We connect the environments securely, for example through VPN.

What happens if we want to leave?

You own your systems and your data. The platform builds on open standards and open-source components, so your data and workloads can be moved without being rewritten for a proprietary service.