Open-Source Share & Patch Sovereignty
Why important?
Openness and control over patching secure maintainability and independence from the lifecycle of individual non-EU vendors.
How measured?
Scale 0–5 + N/A:
- 0 = Fully proprietary stack; no independent maintenance/patching capability; dependent on non-EU vendor support.
- 1 = Predominantly proprietary; patches/updates only via non-EU vendors.
- 2 = Partly open source; limited own patching capability.
- 3 = Predominantly open components (e.g. OpenStack/Kubernetes); patching/maintenance controlled in the EU.
- 4 = Open stack with demonstrated EU control over maintenance/patching; no critical dependency on a non-EU lifecycle.
- 5 = Fully open, EU-maintainable stack + verifiable evidence of patch and release control.
- N/A = no reliable evidence
Sources / Evidence
Validation questions (RFP)
- What share of the platform stack is open source, and under which licences? Can the provider build and roll out security patches itself without waiting for a non-EU vendor? For how long, and by whom, are the deployed versions maintained?
Scores comparison
| Provider | Score | |
|---|---|---|
| pluscloud open | 4.0 | SCS/OpenStack; self-operated open source core services (DNS/PKI/identity/monitoring); high patch control. (stated) |
| noris Sovereign Cloud | 4.0 | 100% open source / SCS; independent EU control over patching/maintenance. (stated) |
| SysEleven OpenStack Cloud | 4.0 | SCS-certified OpenStack; open stack, EU patch control. (stated) |
| Infomaniak Public Cloud | 4.0 | OpenStack-based, in-house development; open stack with EU/CH patch control. (stated) |
| STACKIT | 3.0 | Built on open components (Kubernetes/Gardener); operated by Schwarz/STACKIT in DE/AT, independent patching capability. (stated) |
| OVHcloud Public Cloud (inkl. SecNumCloud) | 3.0 | Public cloud OpenStack-based; open source KMS SDK; maintenance/patching on the EU side. (stated) |
| T Cloud Public | 3.0 | OpenStack/K8s/Terraform (OTC); open stack with EU patching capability. (stated) |
| Hetzner Cloud | 3.0 | Standard Linux/KVM; customer manages the OS independently (open); high customer-side patch control. (stated) |
| Cloud Temple Trusted Cloud | 3.0 | Open source focus (XEN fork, OpenShift/Red Hat, OpenStack); OpenShift ties in a US vendor (Red Hat) for the lifecycle. (mixed) |
| AWS European Sovereign Cloud | 2.0 | Proprietary AWS stack; open standards/OSS selectively (EKS/Kubernetes), core proprietary; patch lifecycle via AWS (non-EU vendor). (stated) |
| IONOS Cloud | 2.0 | Commitment to open standards (SECA/EuroStack), KVM/QEMU basis; platform openness/patch control, however, not documented as OSS; operated in EU/DE. (mixed) |
| UpCloud | 2.0 | Own stack (MaxIOPS) + managed K8s; only partly open. (mixed) |
| Exoscale | 2.0 | Own stack + SKS (K8s); partly open, no OpenStack/SCS. (mixed) |
| Scaleway | 2.0 | Own stack + Kapsule (K8s); partly open. (mixed) |
| Delos Cloud | 2.0 | Azure basis; patches/updates via Microsoft (non-EU lifecycle); OSS supported within the boundary. (mixed) |
| Oracle EU Sovereign Cloud | 1.0 | OCI stack proprietary; patch/lifecycle via Oracle (non-EU vendor). (stated) |
| Microsoft Sovereign Cloud | 1.0 | Azure proprietary; patch/lifecycle via Microsoft (non-EU). (stated) |