What AWS’s disconnection test actually proves

On 24 October, AWS plans to disconnect its European Sovereign Cloud from its global network backbone for several hours. The service will remain connected to the internet through European providers, while its EU-based team demonstrates that it can operate without AWS infrastructure outside the EU.

For organisations that depend on those services, that is a useful test. They need evidence that their infrastructure can keep running if connections to systems elsewhere become unavailable.

But a successful test leaves a central question unanswered: which authorities can require the provider to disclose customer data? Choosing a cloud provider requires balancing three distinct pillars: data location, operational control, and legal jurisdiction. Proof of one does not satisfy the others.

Where the ownership question comes in

Keeping data in an EU data center establishes its location. Having an EU-based team operate that infrastructure addresses operational control. Understanding its legal exposure requires examining the companies involved, their obligations and their control over the data.

The CLOUD Act is relevant here. It clarified that providers subject to U.S. jurisdiction can be required, through valid legal process, to disclose data within their possession, custody or control, even when that data is stored abroad. Whether that applies to a particular entity or data held by a subsidiary depends on the facts.

AWS has established German-incorporated entities and EU-based governance arrangements for its European Sovereign Cloud. These are relevant to that assessment, but the disconnection test does not itself establish how they affect exposure to foreign legal demands.

Disconnecting a network does not resolve that assessment. Equally, a provider’s European headquarters should not be treated as sufficient evidence of immunity from foreign legal demands.

For customers, the practical question is how ownership, governance and technical controls work together to protect their data, including when a provider receives a request for access.

What customers should ask

If sovereignty is part of your procurement requirements, ask for evidence you can assess alongside the technical demonstrations:

• Ownership and contracts: Which company are you contracting with, who owns it, and which jurisdictions apply?
• Access: Who can access your data and administer the service, and from where?
• Encryption: Who controls the keys, and what can the provider access without your involvement?
• Government requests: How does the provider assess and challenge requests, and when will it notify you?
• Operational continuity: What happens if access to overseas systems, personnel or software updates is interrupted?

These questions deserve specific answers. A sovereignty claim becomes useful when you can trace it to contractual commitments, documented controls and a corporate structure you understand.

UpCloud’s position

UpCloud is European-owned, founded and registered in Finland. Our EU data centres are operated by UpCloud Oy, our Finnish parent company, and all customers contract with that Finnish entity. These are concrete facts customers can examine when assessing their provider’s ownership and legal structure.

For organisations that require a European-owned provider and a Finnish contracting entity, those facts matter directly to the purchasing decision. They belong alongside the assessment of data location, access controls and operational resilience.

AWS’s test will provide evidence about its ability to operate independently. Customers should expect the same depth of evidence about ownership, jurisdiction and access to their data before deciding whether a service meets their sovereignty requirements.

Explore UpCloud’s approach to European data sovereignty