CLOUD ACT
DIGITAL SOVEREIGNTY
INTERCONNECTION

“Our data is hosted in Europe” is not enough: data transport, the blind spot of sovereignty

Illustration dessinée : un château fort en pierre, pavoisé de bannières bleues et jaunes, dont des ouvriers consolident les remparts, pendant qu’une file de soldats en armure aux plumets colorés franchit le pont-levis baissé au-dessus des douves.
Matthieu de Cremoux
Article by
Matthieu de Cremoux, Product & Marketing Director, France-IX
First published on LinkedIn on 15 April 2026 · view profile

“Our data is hosted in Europe” has become the reassuring argument par excellence. The problem: it is not enough to ensure digital sovereignty.

When people talk about data sovereignty, the reflex is to look at where the data is stored. That is the basics, it is good, and it is not enough.

There are other questions at stake, such as: which way does this data travel to reach where it is hosted? Who operates the infrastructure that carries it? And above all, which law is it subject to?

Let us take two concrete examples.

AWS has launched in Germany an offer independent of its American parent company. Technically, the data stays on European soil and governance is local, but legally the debate remains open, and this company may still be subject to US law. Notably the Cloud Act of 2018, which allows US authorities to access data hosted by American companies, wherever it is in the world.

The same logic applies to offers such as Bleu (the partnership between Orange, Capgemini and Microsoft) or S3ns (between Thales and Google). These solutions make it possible to run American software on infrastructure operated in France, without direct control from the United States: for ANSSI (France’s national cybersecurity agency), they are not subject to extraterritorial law (SecNumCloud). For Nextcloud, it is not so clear. It is a (genuinely) welcome step forward. But the software remains American.

In both cases, progress has been made: the data is less exposed.

But if the transport of the data is not controlled, we remain highly vulnerable, and these investments will be wasted.

Data transport is the blind spot of sovereignty.

Hosting in Europe is of little use if the data is carried by players subject to foreign jurisdictions, or over routes the company does not know.

The answer to this problem involves two things.

  • Interoperability + diversity: not depending on a single player, a single piece of software or a single path for your data. The more you diversify paths, while being able to switch from one to another, the more you reduce vulnerabilities;
  • Neutral and sovereign transit infrastructure: Internet exchange points that keep European traffic in Europe, operated by players subject neither to the Cloud Act nor to any extraterritorial jurisdiction.

This is precisely what France-IX builds every day: a neutral, sovereign interconnection infrastructure that ensures your data stays local whenever possible and, when necessary, crosses Europe through European players, without exposure to foreign jurisdictions.

Neutral and sovereign interconnection
Why peering?
Learn more

This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post

Let's carry out your project together !

Start now