The large providers deliver good technology. But Amazon, Microsoft and Google are US-owned and subject to US law, even when the servers stand in Europe. That means access to your data can ultimately be decided by rules you have no influence over and will not necessarily be told about.

For many businesses, that is something you can live with. For those who run critical infrastructure, it is harder to look past. Here it is not only a question of data being confidential. It is a question of operations being able to continue, and of the data staying inside the EU if the conditions around us change. That realisation is what has moved the question out of the IT department and up to the leadership.

Three things you need to be clear about

The first is ownership. Not who you hold a contract with, but who actually owns the company behind it, and which country’s laws it is subject to all the way up through the ownership chain.

The second is the legislation. An address in Europe is not the same as European law, if the parent company sits elsewhere. It is the ownership, not the location of the server, that determines who can gain access.

The third is the access itself. Who can demand to reach the data, and would you find out if it happened. It is an uncomfortable question to ask, but it is better asked now than afterwards.

If you cannot answer those three, it is rarely because someone made a mistake. It is usually because the decision was taken back when the question was not yet on the table.

Control does not come at the cost of operations

You do not have to choose between having a grip on your data and having it operated properly. A European cloud can do everything a large international provider can when it comes to uptime, redundancy and monitoring. The difference lies in who owns and runs it.

Edora is Danish-owned and Danish-operated at every level. There is no non-European parent company, and there is no foreign legislation that can reach into operations. The data stays in Denmark, and therefore in the EU, and there are Danish people behind it whom you can get hold of if something needs dealing with.

Very few organisations can move everything at once, and there is no reason to either. But you can start by getting an overview: which systems are critical, where does the data sit today, and how dependent are we really on infrastructure we do not control ourselves. That is a basis for a decision, not a commitment to anything.

Where the data sits has stopped being a technical detail. So it should not be the IT department alone that decides on it either.