The conversation about data sovereignty has been getting louder in Europe for two years, and much of it is settled with an argument that does not survive the first question: “my data sits in a European region.” The physical location of the disk is a necessary condition and decides almost nothing on its own. What decides is which law the contract is signed under, who answers a foreign court order, and how much it costs to undo the decision three years from now.
In short: a European public cloud is assessed with four questions, the jurisdiction of the contract, certifications that are verifiable with a named holder and a declared scope, technical dependency on the provider’s APIs, and the real cost of leaving. All four are answered by reading documents, not brochures. What follows is how to check each one, and where AireCloud fits in, the public cloud of Grupo Aire, the group Stackscale belongs to.
What “sovereign public cloud” means, and what it does not
The term has been stretched until it lost its usefulness. Three criteria that can actually be verified narrow it down again.
The jurisdiction of the contract. This is not where the servers are: it is which legal entity signs the service contract and which courts it submits to. A European subsidiary of a US provider signs under European law, but its parent company remains subject to the legislation of its home country, and that is where the friction with the CLOUD Act appears.
Operational control. Who administers the platform, where the control plane is accessed from, and who holds privileged credentials over the infrastructure. A service operated from outside the European Union by staff in a third country is sovereign on paper and little more.
Reversibility. A dependency you cannot leave without rewriting your applications is a form of losing control, even if the contract is Spanish and the disk is in Madrid.
We develop this distinction in our article on cloud sovereignty and which laws govern your company’s data, which is the recommended starting point if the question is legal before it is technical.
The four questions that actually decide
1. Who signs the contract, and under which law?
Look at the legal entity named in the terms of service and at the governing law and jurisdiction clause. If the signing entity is incorporated outside the European Union, or if it is a subsidiary whose parent is subject to extraterritorial legislation, the data can sit in Madrid and the access request can still arrive from another jurisdiction.
2. Which certifications does it hold, in whose name, and with what scope?
A certification without a named holder and a declared scope is worth nothing. Demand three things: the exact name of the certified entity, the declared scope, meaning which services and which sites it covers, and the certification body. This is public information and the provider should publish it without being asked.
Check, too, that the certification belongs to the entity that actually provides the service. In corporate groups with several companies, certificates are commonly spread across them, and a certificate held by a sister company does not cover the service you are contracting.
3. Which APIs does the application depend on?
This is the question most often neglected and the one that turns out most expensive. A virtual machine moves between providers with relative ease; an application built on proprietary managed services, queues, functions, databases with their own dialect, identity, moves by being rewritten.
4. How much does it cost to leave?
The exit bill has two components that do not show up in the calculators: egress traffic and engineering time. The first is measurable in advance and should be requested in writing; the second depends entirely on the answer to the previous question.
Certifications: what each one actually proves
The certifications quoted in the Spanish cloud market are not interchangeable, and each one answers a different question.
| Certification | What it proves | Who it is decisive for |
|---|---|---|
| ENS High | Compliance with the Spanish National Security Framework at its most demanding level, under Royal Decree 311/2022 | Spanish public administrations and their suppliers. Without ENS there is no public contract |
| ISO/IEC 27001 | An audited information security management system under continuous improvement | Any organization with contractual security requirements |
| ISO/IEC 27017 | Security controls specific to cloud services, with an explicit split of responsibilities between provider and customer | Anyone who needs to know which part of security is theirs |
| ISO/IEC 27018 | Protection of personal data processed in the cloud by the processor | Controllers subject to the GDPR |
| ISO 22301 | A business continuity management system | Critical services and auditable contingency plans |
| Gaia-X | Membership of the European federated cloud initiative and adoption of its specifications | A signal of European alignment; it does not replace a security certification |
Two points to keep in mind. ENS High is the one that opens the door to the public sector, and a provider without it is out of the tender regardless of how good its platform is. And Gaia-X is not a security certification: it proves participation in a European federation project, which is valuable as a signal but is not equivalent to an audit of controls.
In the case of AireCloud, the entity holding the certifications applicable to the service is Aire Networks del Mediterráneo S.L., and they are published with holder and scope on the group’s certifications page: ISO 9001, ISO 14001, ISO 22301, ISO 27001, ISO 27017, ISO 27018 and ENS High level. Having them published under the name of the certified entity is exactly what you should demand from any provider, this one included.
Technical dependency: OpenStack versus proprietary APIs
This is where it is decided whether reversibility is real or just a clause.
AireCloud is built on OpenStack, with a management layer developed by Aire. The practical consequence matters more than the architecture: the compute, network, block storage, image and identity APIs are those of an open source project with more than fifteen years behind it and many deployments, so the automation tooling that works against one OpenStack cloud works against the others. Terraform, Ansible and the native clients do not have to be rewritten when you change provider.
If the concept is unfamiliar, we explain it in detail in what OpenStack is.
This does not make a migration trivial, the data, the integrations and the testing are all still there, but it does remove the most expensive part, which is rebuilding the provisioning layer. The difference between migrating an infrastructure described in Terraform against standard APIs and migrating an application coupled to proprietary services is measured in months.
On top of that substrate, AireCloud exposes managed services that also rely on OpenStack’s own projects: databases (MySQL, PostgreSQL and MariaDB), load balancing, NFS shared storage, managed Kubernetes, object storage compatible with the S3 API, and bare-metal servers provisioned as if they were instances.
The cost that does not show up in the calculator
The two line items that break public cloud budgets are egress traffic and API calls to storage services. At the large international providers both are billed by usage, and the second is particularly hard to estimate before the application is in production.
This is where the proposition of an operator with its own network separates from that of a hyperscaler. AireCloud runs on Grupo Aire’s fiber network, and includes symmetric 1 Gbps connectivity with no charge for downloaded traffic or for traffic between zones. For workloads that serve a lot of content, media, e-commerce, file distribution, backups to an external repository, that single line can change the outcome of the comparison more than the price per vCPU.
Object storage follows the same approach: compatible with the S3 API and with no charges for API calls or outbound transfer, which makes predictable a cost that at other providers is only known after the fact.
What AireCloud is and where it fits
AireCloud is the public cloud of Grupo Aire. It needs describing precisely, because the term “public cloud” is used for very different things.
Model. Infrastructure as a service on OpenStack, with its own orchestrator. The customer works within a corporate space, a domain, inside which they create virtual data centers, called projects, that can span regions.
Regions. As of October 2026 the platform operates two regions in Madrid, at Equinix and at Albasanz, interconnected by the group’s own fiber, which makes it possible to deploy in high availability across both with low latency and to choose from the panel where each workload lives. The group plans to extend the map with new regions.
Network. This is the differentiating asset, and the reason matters. Grupo Aire operates its own NG-DWDM network of around 35,000 kilometers, with a physical presence in Spain, Portugal and the Netherlands and capacity in France, the United Kingdom, Belgium, Germany, Switzerland, Italy and the United States, more than a thousand peering agreements and an autonomous system among the hundred most relevant in IPv4. Communication between data centers and the route out to the internet travel over that fiber, not over third-party transit.
Catalog. General purpose, high speed and dedicated compute on AMD EPYC and Intel Xeon; compute with NVIDIA GPUs; bare metal as a service; several tiers of block storage by performance, from archive to local NVMe; S3-compatible object storage on NetApp technology; backups with Cinder or with Commvault; disaster recovery as a service; live migration from other clouds and hypervisors; CDN with WAF, bot mitigation and anti-DDoS protection; and a dedicated connection from the customer’s own sites.
Operation. The panel lets you deploy by dragging components onto a canvas, with real-time metrics and consumption forecasting, and exposes an API to automate the same things you do by hand.
Support. In Spanish and by an in-house team. That sounds minor until the first incident at three in the morning with a provider that answers in English and in another time zone.
What AireCloud is not: a hyperscaler with a catalog of hundreds of managed services, nor the cheapest option for a small, occasional workload. Anyone looking for a serverless functions product with thirty native integrations will not find it here.
Public cloud, private cloud or dedicated infrastructure
The two models are often presented as rivals and work better as complements. At Stackscale we have spent years in the opposite conversation to this article, companies moving out of public cloud and into dedicated infrastructure, and the conclusion after many projects is that the question is not answered in the abstract but workload by workload.
| Situation | Better fit |
|---|---|
| Variable load, unpredictable peaks, test environments that come and go | Public cloud: you pay for what you use and switch off what you do not |
| Stable, well-known load running twenty-four hours a day for years | Dedicated infrastructure or private cloud: the cost per unit of performance is lower and predictable |
| Demanding isolation, compliance or storage performance requirements | Private cloud on dedicated infrastructure |
| Elasticity needed for one part of the system and stability for another | Hybrid, with a dedicated connection between both environments |
| Disaster recovery for an environment that lives somewhere else | Public cloud as the target, paying only for capacity at rest |
The last case is the most underused. Keeping a backup site powered on all year to use it for one day is expensive; keeping the replica in a public cloud that is billed by usage and brought up when needed changes the economics of the continuity plan entirely. We cover this on our Disaster Recovery and backup page.
For the classic contrast between the two models, private cloud versus public cloud still holds.
How to check what a provider tells you
A short list, meant to be taken into the meeting:
- Ask for the contracting entity and the jurisdiction. It must be in the general terms, not in an answer from a salesperson.
- Ask for the certificates with holder, scope and certification body, and check that the holder is the entity providing the service.
- Ask where the platform is operated from and who has privileged access.
- Ask in writing for the cost of egress traffic and for the cost of object storage API calls.
- Run the reversibility test: ask what would have to be rewritten to move the application to another provider, and ask for the answer broken down by component.
- Check the dates on the certifications. An expired ISO, or one under renewal, is a different conversation.
- Check whether there is a minimum term and how long the termination notice period is.
Frequently asked questions
What exactly is a sovereign public cloud?
A public cloud whose operation, contract and data remain under European jurisdiction, so that no authority of a third country can compel access from the provider through its own national legislation. The location of the data centers is only one of the requirements: the signing entity, operational control and the subcontracting chain count just as much.
Is it enough for the data center to be in Europe?
No. A European subsidiary of a provider subject to extraterritorial legislation may be obliged to comply with requests from its home country even if the data physically resides in the European Union. The right question is who signs the contract and which law it is subject to.
What does ENS High guarantee, and who cares about it?
It certifies compliance with the Spanish National Security Framework at its most demanding level, regulated by Royal Decree 311/2022. It is mandatory for the systems of Spanish public administrations and for the providers that serve them, so it determines whether a provider can bid for public contracts. Outside the public sector it works as a very detailed security audit with external oversight.
What is the difference between ISO 27001, 27017 and 27018?
27001 certifies the information security management system of the whole organization. 27017 adds the controls specific to cloud services and, above all, establishes which responsibilities belong to the provider and which to the customer. 27018 focuses on the processing of personal data in the cloud. Holding all three covers three distinct layers; holding only the first leaves the specifically cloud part uncertified.
Does Gaia-X certify anything?
Gaia-X is a European federated cloud initiative with its own transparency and interoperability specifications. Belonging to the project indicates alignment with that framework, and it is not equivalent to a security certification audited by a third party. Quote it for what it is.
What does it mean for a cloud to be built on OpenStack?
That the infrastructure APIs are those of an open source project used by many providers, so the automation work is portable between them. It reduces vendor dependency in the provisioning layer, which is the most expensive to rebuild. It does not remove the work of migrating data or validating the application at the destination.
How much does it cost to get data out of a public cloud?
It depends on the provider and it should be requested in writing before signing. At the large international providers egress traffic is billed per gigabyte and is usually the line item that turns a migration into a budgeted project. Some European providers, AireCloud among them, do not charge for downloaded traffic, which removes that barrier.
When does public cloud make sense, and when dedicated infrastructure?
Public cloud wins on variable loads, ephemeral environments and disaster recovery targets. Dedicated infrastructure wins on stable, sustained loads, where the cost per unit of performance is lower and also predictable. Most companies of a certain size end up combining both, with a dedicated connection between the two environments.
Where Stackscale fits
Stackscale is part of Grupo Aire, and having both models inside the same group makes it possible to have the whole conversation instead of defending a single answer. When the load is stable and demanding, we deploy private cloud and bare-metal servers on dedicated infrastructure in our data centers in Madrid and Amsterdam, with our own network, network storage and synchronous replication. When what is needed is elasticity, a recovery target or an additional public region, the group’s public cloud joins the same architecture over the same network, without leaving European jurisdiction or changing who you talk to.
If you are evaluating which provider to move a platform to, or reviewing which dependencies you have accumulated with the one you already have, let’s talk about your project and size it with your own data.
