Sovereign Cloud Gets a Real Budget
Data-residency rules and geopolitical distrust are shifting public-sector and regulated-industry cloud procurement toward locally controlled platforms. The requirement is expanding from where data is stored to who operates the infrastructure, controls encryption keys and can be compelled by foreign law. European and Japanese technology groups with domestic personnel, security clearances and government relationships gain strategic value. US hyperscalers remain formidable but face duplicated infrastructure, local partnerships and some loss of high-value workloads.
How this story could end...
The endings this story genuinely supports, written from the same evidence as the story updates. The value ranges are illustrative examples of how the affected companies as a group could re-rate — not forecasts, targets or advice.
Mapping out the endings…
How the two sides have traded
The bull and bear baskets for this story, equal-weighted and indexed so the two lines start together.
Each scenario's basket — 3 months
Both sides on one chart — 10 stocks on the bull side, 10 stocks on the bear side. Neither side is emphasised.
Each line tracks the 10 companies most exposed to this story, so a broad basket of loosely related names does not flatten it. The full list below is unchanged.
Jul 20, 2026 – Oct 20, 2026 · 70 sessions
Equal-weighted performance of the 10 most exposed stocks over the last 3 months.
No data for TKA.VI, ATEA.OL, 3778.T, 3774.T, 030200.KS, GIB-A.TO, TIT.MI, BC8.DE, KPN.AS, SCMN.SW, 4307.T, 064400.KS, 181710.KS, 2412.TW, TATACOMM.NS, TOTS3.SA
Most affected stocks
Bull case
SAP can combine sovereign cloud deployment with mission-critical enterprise software and European data governance.
Fujitsu's entrenched Japanese public-sector relationships position it for nationally controlled cloud-modernization contracts.
Its France-based OUTSCALE subsidiary provides SecNumCloud-qualified infrastructure that directly addresses sovereign hosting, operator-control and encryption requirements.
HPE GreenLake and private-cloud infrastructure let governments reproduce cloud operating models on dedicated, locally controlled or air-gapped systems.
NEC's government relationships, domestic systems-integration workforce and security technology make it a key candidate for Japanese sovereign-cloud programs.
Indra's deep role in Spanish government, defense and critical infrastructure positions it to integrate domestically controlled cloud and cybersecurity systems.
Samsung SDS provides domestic cloud, cybersecurity and systems-integration services to Korean enterprises and public institutions with stringent control requirements.
OVHcloud is a European-controlled cloud provider positioned to capture workloads requiring strict jurisdictional independence.
Capgemini benefits from the integration, migration and compliance work required to build sovereign cloud environments.
The European IT-services group can design and operate sovereign-cloud environments using locally cleared personnel for governments and regulated industries.
Bear case
Centralized observability can expose sensitive logs and telemetry to foreign legal jurisdiction, encouraging sovereign-cloud customers to favor local or self-hosted monitoring.
Alibaba Cloud benefits from localization inside China but geopolitical distrust and national-security restrictions limit its access to sensitive government workloads in many foreign markets.
Google Cloud's smaller enterprise footprint makes the added cost of country-specific sovereign infrastructure harder to absorb.
AWS risks procurement leakage where governments require ownership or operational control beyond standard data residency.
Requirements for domestic operators and locally controlled encryption can force Cloudflare to duplicate its global edge architecture or exclude sensitive traffic from its shared network.
Snowflake's dependence on underlying hyperscalers and US corporate jurisdiction can disadvantage it when customers require locally controlled operators and encryption keys.
Identity systems control access and encryption-adjacent credentials, making Okta vulnerable where procurement rules require domestic operation and freedom from foreign legal compulsion.
Oracle can mitigate the pressure with dedicated sovereign regions, but US ownership and the cost of duplicating infrastructure may constrain its most sensitive overseas workloads.
Government and regulated-industry payroll and personnel records may be steered toward domestically controlled platforms rather than a US-operated SaaS control plane.
Microsoft must accept higher compliance costs and local operating constraints to keep sensitive Azure workloads.
Reporting behind this story
Looking at what moved this story…