--- title: "Data sovereignty" description: "Why European banks need sovereign real-time data. Run Apache Flink with Ververica on your own infrastructure or in your own AWS or Azure account." lastUpdated: 2026-10-19T08:43:28.000Z source_url: html: "https://www.ververica.com/data-sovereignty" md: "https://www.ververica.com/data-sovereignty.md" --- # Keep Your Real-Time Data Under Your Control Ververica is a European company, headquartered in Munich, Germany. Apache Flink® born in Berlin. Run Ververica self-managed in your own data center, or as BYOC in your own AWS or Azure account, so your data stays in the infrastructure and region you choose. ## What does data sovereignty mean for a real-time streaming platform? Data sovereignty for real-time streaming means you, not your vendors, control where streaming data is stored and processed and who can reach it. Ververica GmbH is a European company based in Munich, Germany. Its Apache Flink platform runs where you decide: self-managed on your own infrastructure, which needs no connection to Ververica, or as BYOC in your AWS or Azure account and region. ## They Told You Cloud Was Borderless. They Lied. ### Data has nationality. ### And yours is probably American 🇺🇸 by default. When your streaming platform runs on AWS, Azure, or GCP: - Your data is subject to US surveillance laws ([CLOUD Act](https://www.justice.gov/criminal/cloud-act-resources), [FISA 702](https://www.congress.gov/crs-product/R48592)), even in EU regions - American intelligence agencies can access it without notifying you - Your GDPR compliance is theater when the platform provider has US headquarters - EU data centers don't protect you when the company answers to US jurisdiction **Confluent? Databricks? Kinesis?** American companies. US jurisdiction. **Great tech. Wrong passport.** It's not paranoia. It's the law. The CLOUD Act gives US authorities jurisdiction over data controlled by US companies, _regardless of where it's stored._ You didn't build your European business to hand your most sensitive data to a foreign government. But that's exactly what happened. ## Here's what it requires What Real Data Sovereignty Looks Like ### European Corporate Entity Ververica GmbH is registered in Munich, Germany (Amtsgericht München, HRB 309285). Your contract and your support are with a European company. ### Your Data Stays With You With self-managed deployment, Ververica does not run your clusters and has no access to your data. With BYOC, your data stays in your own cloud account and region. Your contract is with Ververica GmbH in Munich. Which laws apply to your cloud provider is a question for your own legal team. ### Full Deployment Control - Self-managed: Your EU infrastructure, your servers, your control - BYOC: your own AWS or Azure account, in the region you choose - Managed Service: EU data centers, EU contracts, EU operations teams ### Apache Flink®: Born in Berlin Created at TU Berlin by our founders. European innovation from day one. The team that invented Flink still leads it. ### Auditable Stack Self-managed deployments need no connection to Ververica. Complete data lineage supports GDPR Article 30 records and DORA audit trails. When regulators ask where the data went, you can show the **lineage.** ## Your Data Sovereignty Checklist | Feature | Ververica | US Platforms | | --- | --- | --- | | EU corporate entity | ✓ | ✗ | | Contract with an EU company | ✓ | ✗ | | EU-only deployment options | ✓ | ✗ | | European technology origins | ✓ | ✗ | | Auditable supply chain | ✓ | ✗ | | Self-managed option with no connection to the vendor | ✓ | ✗ | ## If You're in These Industries, This Isn't Optional If your regulator would flinch at "Our real-time platform is American," keep reading. DORA mandates third-party risk management. If your regulator asks why transaction data touches US infrastructure, what's your answer? Score your platform with the self-assessment checklist for financial institutions. Patient data sovereignty under GDPR Article 9. Clinical trials and genomic research can't be exposed to foreign governments. NIS2 essential entities. Sovereign data requirements for national security. Procurement favors EU providers. Network telemetry = national security. Real-time subscriber analytics for hundreds of millions of EU citizens. ## FAQ ### Can't we just use AWS EU regions with data residency controls? Data residency (where data is stored) is not the same as data sovereignty (which laws can reach it). Under the US CLOUD Act, providers subject to US jurisdiction can be required to disclose data they control, even when it is stored outside the US. With Ververica BYOC, the data plane runs in your own AWS or Azure account; with self-managed, it runs wherever you choose, including your own data center. ### What about managed streaming services in EU regions? Check where the provider is headquartered and which laws apply to it. A service in an EU region can still be run by a company that is subject to non-EU law. ### Does this cost more than US platforms? Ververica delivers 40% lower TCO. But the real question: What's the cost of regulatory non-compliance? Of being the next Schrems case study? The cheapest option is the one that doesn't shut down your business. ### What if we need global deployment? Data sovereignty doesn't mean isolation. Run Ververica globally with EU data in EU regions. The difference: You control where each workload runs.