Delivering a secure, open, and sovereign digital world

The global conversation about our digital future goes beyond technology; it’s about architecting a prosperous, secure, and resilient economy where the digital services we rely on every day — from banking to healthcare to public administration — are built on a foundation of trust and operate according to local regulations.

At Google Cloud, we believe that achieving this vision shouldn’t require compromises. That’s why we designed our Sovereign Cloud portfolio — consisting of Google Cloud Data Boundary, Google Cloud Dedicated, and Google Cloud Air-Gapped — to provide the industry’s most comprehensive and flexible options to meet your unique needs. We believe that you can drive innovation without compromising functionality.

Today, we are expanding on that promise for governments, businesses, and citizens across the world. Our commitment is built on five key pillars: investing in local economies through infrastructure and workforce development; enabling digital resilience via rigorous technical and legal controls; empowering customers to control access to their unencrypted data; ensuring an open digital future by supporting open-source software and eliminating lock-in; and actively supporting global cybersecurity and regulatory frameworks.

Foundation of economic growth

Digital sovereignty is fueled by cloud services, yet it is equally dependent on a foundational commitment to the nations we serve. We demonstrate this by fostering local innovation, creating jobs, and having local entities operating under local law across many parts of the world.

Over the past few months, we have accelerated this commitment worldwide:

• Asia-Pacific: We support national agendas like India’s Viksit Bharat and Malaysia’s Ekonomi MADANI framework with multi-billion dollar investments, including new cloud regions in Thailand and Malaysia, and AI partnerships in Singapore. We also launched the TalayLink and Dhivaru subsea cables to significantly boost digital resilience and connectivity across the Indian Ocean and Asia-Pacific.
• Europe: Today, we operate 13 Cloud regions spanning Europe, from Finland to Spain. This investment includes a new region in Sweden and our new Sovereign Cloud Hub in Germany, complementing our existing cybersecurity hubs in Dublin, Malaga, and Munich. We understand the importance of local oversight for local operations. That’s why our European datacenter operations and their boards are overseen by European boards operating under local law and comprising European nationals who are based in Europe. We have established dedicated public sector entities in Germany and the U.K. and have an established European Advisory Board that serves as an important feedback channel and critical voice, helping ensure our products and services meet European requirements.
• Latin America: We’re strengthening regional AI innovation by deploying local Tensor Processing Units (TPUs) and bringing Gemini on-premises in Brazil. In Chile, we solidified the country’s role as a digital gateway by commencing the Humboldt Cable — the first direct subsea link between South America and Asia-Pacific. These investments are backed by our Capacita+ program, committing to train 200,000 people in generative AI.
• Middle East and Africa: In the Middle East, we are strengthening sovereign infrastructure with a partnership in Turkey, and recently launched phase two of the Kuwait National Skilling Initiative to train government employees in AI and cybersecurity. We announced a strategic initiative to support the United Arab Emirates as a leader in cybersecurity innovation and education by establishing a center of excellence in Abu Dhabi. In Africa, we established the continent’s first direct fiber link to Australia with the Umoja cable, and announced a broader skilling initiative providing Gemini Advanced to students across African nations.
• North America: In the U.S., we are making substantial long-term investments in infrastructure and workforce development, including the AI Works initiative to boost AI skills development and economic growth. In Canada, we are upskilling more than 2 million people in AI and expanding our Toronto engineering hub, a critical center for global AI talent.

Assurance of operational continuity

Society relies on the continuous operation of the services provided by Google Cloud’s customers. We prioritize security and digital sovereignty to keep these vital systems running and protected from external threats. Google Cloud complies with key EU cybersecurity regulations, such as NIS2 and DORA. We support customer compliance efforts with robust contractual commitments and additional security offerings, including Google Security Operations and Mandiant Consulting.

We back this technical resilience with clear legal protocols: Should Google receive an order from a national government to suspend or terminate the provision of Google Cloud’s operations provided from any country, we will seek to limit, modify, or object to any such order using all available legal avenues. As part of our commitment to partnering with local service providers to build local solutions, customers don’t have to contract with Google to take advantage of these offerings.

Additionally, in the event that Google becomes unable to operate Google Cloud, where Google Cloud could otherwise be operated by a third party, Google will make arrangements to allow a qualified third party to take on this operational role.

And finally, Google will allow qualified, locally-based entities that are subject to local law and whose board members are obligated to act in the best interest of those entities to utilize Google’s code to provision Google Cloud’s products, services, and solutions in their respective territories.

The offerings in our Sovereign Cloud portfolio also help you protect your cloud environments. Google Cloud offers a portfolio of survivable solutions that meet a broad range of requirements. These are available today with our Google Cloud Air-Gapped and Google Cloud Dedicated offerings.

Google Cloud Air-Gapped doesn’t require connectivity to Google Cloud or the public internet to manage infrastructure, services, APIs, and tooling. Customers may choose to have a third-party partner (instead of Google) serve as the infrastructure operator for Google Cloud Air-Gapped. It is built on industry-leading open-source components and designed to remain disconnected in perpetuity. Because there is no physical connection, Google cannot remotely access or shut down customer workloads running in Google Cloud Air-Gapped.

Around the world, organizations including NATO Communication and Information Agency, the German Armed Forces, the U.K. Ministry of Defence, Singapore government agencies, and the U.S. Air Force have selected Google Cloud Air-Gapped for their most secure workloads.

Similarly, Google Cloud Dedicated is designed so that the partner fully controls the environment, including the ability to monitor, and, in exceptional circumstances, block software updates, and revert changes made by Google. Google Cloud Dedicated performs a key rotation after the disconnect and Google has no access to this dedicated instance. The solution is designed to prevent Google from any remote access or the ability to shut down customer workloads running in Dedicated instances, and so that the partner can continue to operate for up to 12 months in the unlikely scenario that their Dedicated instance connection to Google is severed.

For example, in France, S3NS offers Premi3NS built on Google Cloud Dedicated. S3NS is a standalone entity and PREMI3NS has achieved the SecNumCloud 3.2 qualification from the French National Agency for the Security of Information Systems (ANSSI). Recognized as the most demanding sovereignty, security, and resilience standard in Europe, and one of the most demanding in the world, this certification confirms that the platform meets the highest protection requirements and offers full, auditable control over access to customer data for our local partner. Highly-regulated customers such as Thales, EDF, MGEN, and Qonto are already building on Premi3NS to accelerate their digital transformation.

Your data, your control

At its core, digital sovereignty is about individuals and their data. Our commitment to you is that you control your information and data.

We were the first major cloud service provider to eliminate transfer fees and introduced tools to make such transfers easier. We continue to proactively advocate against restrictive cloud licensing policies that lock in cloud customers, harm economic growth, and stifle innovation.

We are the only major cloud provider that enables customers to deny access to their unencrypted data for any reason. We offer the ability to require approval before specific administrative activity occurs along with a mechanism for customers to ensure their approvals are legitimate.

Capabilities like these help ensure that customers are the ultimate arbiters of access to their data on Google Cloud.

Our External Key Management solution enables customers to encrypt their data at rest with keys stored outside our cloud. It requires detailed justifications each time access to their keys is requested. Google Cloud will challenge overbroad and unlawful data requests, and seek appropriate judicial remedies.

We are fully committed to ensuring that legal requests are subject to transparency, and report these out to the public through our Transparency Report.

Sovereign Cloud from Google provides customers with controls that are designed to facilitate the processing and storage of customer data in a given region, protected by local laws. This extends to Google Workspace, where client-side encryption ensures that your collaboration data is indecipherable to Google, keeping your emails, documents, and meetings strictly under your control.

We recognize that data residency alone often isn’t enough — you need assurance that the actual machine-learning processing occurs in your required jurisdiction. We recently expanded our local ML processing commitments for select Gemini models to Australia, Brazil, Canada, France, Germany, India, Japan, Singapore, South Korea, and the U.K. We are continuously expanding our data residency commitments across the globe.

Innovating without limits

A sovereign digital future should be grounded in choice, encouraging the freedom to use the best tools without being tied to a single vendor. Many Google solutions you have come to love, such as Android, Chrome, Kubernetes, and Gemma, are built on open technology, giving developers, businesses, and governments common tools that work everywhere. We are fundamentally committed to an open digital world, building on open-source technology.

We provide unmatched choice through Vertex AI, our AI development platform for building and using generative AI. Vertex AI enables you to develop, tune, and deploy your own models, or you can use and localize Google’s leading models, like Gemini and Gemma. We also provide tools so you can build custom agents, or you can use Google’s pre-built agents to accelerate your time to market.

Get started today

Our commitments to verifiable control, assured resilience, local investments, and open choice are our pledge to help build a digital future that is innovative, secure, and truly sovereign. To learn more about our digital sovereignty solutions, visit our website or reach out to our digital sovereignty experts.