Does on-premises hosting guarantee data sovereignty under regulations like NIS2 and DORA?
On-premises keeps your data physically and legally under your control, which is the foundation of data sovereignty. It does not by itself make you compliant with NIS2 or DORA: you still need to assess your obligations regularly and secure and operate the system accordingly.
Why on-premises matters for data sovereignty
Regulations such as the 2018 US CLOUD Act, NIS2, DORA and the Cyber Resilience Act have shifted the conversation from where data physically sits to which legal jurisdiction applies to the vendor handling it. A 2025 French Senate hearing made this concrete when Microsoft confirmed under oath that it would have to hand over customer data if US authorities requested it, even when that data was stored in Europe. This has pushed many organisations, including government bodies in France, to move away from US cloud providers.
What on-premises gives you
Across all three on-premises options, air gap, self-hosted and managed server, your data stays physically on your infrastructure. The difference is operational: air gap removes outbound connections entirely, self-hosted allows controlled outbound traffic for integrations, and managed server hands day-to-day operations to a trusted vendor while the infrastructure stays yours.
What it does not do on its own
Data sovereignty is not the same as regulatory compliance. NIS2 and DORA also cover areas such as security patching, incident handling and operational resilience. That's why you should reassess at least once a year whether your organisation falls into a more strictly regulated category, and whether some components need to be internalised or air gapped.
- Air gap suits environments where any outbound data flow is forbidden
- Self-hosted suits teams needing integrations while keeping full infrastructure control
- Managed server suits organisations wanting ownership without an internal operations team
