When a company chooses a cloud provider, the first question is almost always “where is my data?”. It is the right question, but it is not enough. A data center in Italy tells you where the files are stored, not which law governs them or who can access them.
1. Three questions, not one
- Where is the data? Physical residence, backup copies included.
- Which law applies? That of the country hosting the data center, but also that of the provider and its parent company. A service delivered in Italy by a provider subject to a non-EU law, such as the US CLOUD Act of 2018, may remain exposed to access requests from foreign authorities even if the servers are in Europe.
- Who can access it? Staff, subcontractors and authorities, and from which countries.
A truly sovereign cloud therefore needs three things together: the same jurisdiction, operational control and compliance.
2. Why it matters now
- GDPR, Chapter V (arts. 44-49): transfers of data outside the EU require a legal basis. After the Schrems II ruling (2020) the EU moved to the Data Privacy Framework (2023), upheld by the EU General Court in September 2025 but still subject to litigation.
- NIS2 (Italian Legislative Decree 138/2024, art. 24): supply chain security is part of the required measures, and the cloud provider is part of that chain.
- DORA: in the financial sector the contract must state the locations where data is processed and stored.
- Public administration: ACN Regulation no. 21007/24 (27 June 2024, applicable from 1 August 2024) ties the choice of qualified cloud services to data classification, split into three classes: ordinary, critical, strategic.
3. Six questions to ask your provider
- In which data centers and in which countries are data and backup copies located?
- Which law is the provider subject to, parent company included?
- Which subcontractors process the data?
- How does it handle access requests from non-EU authorities?
- How much contractual notice does it give before changing processing location?
- Which certifications and qualifications does it hold (ISO/IEC 27001, 27017, 27018, ACN qualification)?
4. What the ACN qualification means
For cloud services intended for the public administration, qualification is a conformity check carried out by ACN, the Italian National Cybersecurity Agency, before the service appears in the Agency’s public catalogue. It lasts 36 months and, during this period, ACN checks that the requirements continue to be met. Qualification levels are tied to data classification: the higher the level, the more sensitive the data the service can process.
5. What FinGreenTech does
FinGreenTech holds the ACN QC2 qualification for cloud services intended for the public administration, and the ISO/IEC 27001, 27017 and 27018 certifications. Virtual machines, mail and web servers run on TIER IV data centers in Italy (Vianova in Pisa, CONSIS/Retelit in Rome), with a single point of contact for systems, cloud, security and backup. Where the requirements are met, cloud services can be funded through the MIMIT Cloud & Cybersecurity Voucher.
Sovereignty is not a label: it is a set of verifiable answers. Request a consultation or write to us at info@fingreentech.com, and we will check them together on your case.
Sources: ACN, Cloud Regulation for the public administration; ACN, classification of data and services (19 April 2022).
Transparency note. This article was drafted with the support of artificial intelligence tools and reviewed by the FinGreenTech Team, which is editorially responsible for it.
