For EU manufacturers, the question is where the data sleeps

Procurement at a European manufacturer asks the same question every time. Where does the data sit at rest, where does it sit during processing, and which jurisdiction can compel access to it? The good vendors have a one-page answer. The rest have a slide deck.

For most of the last decade, the easy bet was the US-headquartered cloud with an EU region. It was good enough for most workloads, and the procurement team eventually accepted it because everyone else was doing the same thing. Schrems II made that conversation harder. The Cloud Act made it harder again. By 2025 a lot of industrial clients had quietly moved on from “good enough” and started asking for something a procurement officer can defend in writing.

What that looks like in practice is unglamorous. EU-headquartered hosting providers. Self-hosted object storage when the workload tolerates it, on hardware physically located in a known jurisdiction. Identity providers that do not phone home. An audit trail that proves where every bit of every file lived for the last twelve months.

None of this is exciting. None of it is on a vendor’s homepage. All of it is what gets you through procurement at a 40-year industrial firm whose lawyers have read the same regulatory text you have.

The fashionable framing is “sovereign cloud.” We do not love the term. The work is older and quieter than that. Pick infrastructure you can defend in a meeting room. Write down where the data lives. Audit it. Pay the cost of the boring choice up front.

If you are about to start a project that will hold customer data, designs, or manufacturing telemetry inside the EU, the cheapest decision you can make today is to assume your data residency story will be reviewed by a regulator within five years. Build for that audit. The rest follows.