Oracle EU Sovereign Cloud

Provider-specific sources from the current dataset. Use the Compass for scoring, weighting, and A/B comparison.

Compare in the Compass

Provider Snapshot

Criterion	Score
Customer content in the EU	4.0
Customer-created metadata in the EU	4.0
Physically & logically separated	4.0
EU-based operations & support	5.0
No critical non-EU dependencies	4.0
Ownership / ultimate parent (EU-owned?)	1.0
Controlling interest & FISA 702 risk (jurisdiction ≠ residency)	1.0
Local contracting entity & EU governance (operational model)	4.0
Independent advisory board	3.0
EU root CA / trust services	1.0
BSI C5	2.0
ISO 27001 / ISMS	3.0
IT-Grundschutz (BSI)	0.0
SecNumCloud (ANSSI)	0.0
Open standards / API portability	1.0
Service portfolio depth	5.0
Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)	4.0
Audit reports / evidence pack	3.0
Policy enforcement (guardrails)	4.0
Default deny / secure by default	1.0
Independent verification (continuous)	2.0
Blackbox exposure (ops/control plane)	3.0
Operator access exclusion (workload scope)	4.0
IaC & automation (Terraform/OpenTofu, SDKs, APIs)	4.0
Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)	4.0
Observability (logs/metrics/traces, alerting)	4.0
Limits/quotas (transparency & increase)	3.0
Reference architectures / landing zones	4.0
Unified security stack	5.0
Energieeffizienz / PUE & Zielwerte	2.0
CO₂-/Wasser-Reporting + erneuerbare Energiequellen	3.0

Scope: Cloud Suite (IaaS+PaaS)

Customer content in the EU: 4.0; Customer-created metadata in the EU: 4.0; Physically & logically separated: 4.0; EU-based operations & support: 5.0; No critical non-EU dependencies: 4.0; Ownership / ultimate parent (EU-owned?): 1.0; Controlling interest & FISA 702 risk (jurisdiction ≠ residency): 1.0; Local contracting entity & EU governance (operational model): 4.0; Independent advisory board: 3.0; EU root CA / trust services: 1.0; BSI C5: 2.0; ISO 27001 / ISMS: 3.0; IT-Grundschutz (BSI): 0.0; SecNumCloud (ANSSI): 0.0; Open standards / API portability: 1.0; Service portfolio depth: 5.0; Geographic footprint & redundancy (regions/AZ/DCs in EU/DE): 4.0; Audit reports / evidence pack: 3.0; Policy enforcement (guardrails): 4.0; Default deny / secure by default: 1.0; Independent verification (continuous): 2.0; Blackbox exposure (ops/control plane): 3.0; Operator access exclusion (workload scope): 4.0; IaC & automation (Terraform/OpenTofu, SDKs, APIs): 4.0; Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s): 4.0; Observability (logs/metrics/traces, alerting): 4.0; Limits/quotas (transparency & increase): 3.0; Reference architectures / landing zones: 4.0; Unified security stack: 5.0; Energieeffizienz / PUE & Zielwerte: 2.0; CO₂-/Wasser-Reporting + erneuerbare Energiequellen: 3.0

Sources / Evidence

Customer content in the EU

EU Sovereign Cloud: Regionen in Frankfurt & Madrid; Daten/Processing in EU (stated).

Customer-created metadata in the EU

Separater Realm (Frankfurt, Madrid). Physisch/logisch/kryptographisch isoliert. Keine Verbindungen zu anderen OCI-Realms. Metadaten verbleiben in EU.

Physically & logically separated

EU Sovereign Cloud als eigener OCI Realm: physisch/logisch/cryptographisch getrennt (stated).

EU-based operations & support

Operators EU residents, employed by EU legal entity; support/ops in EU (stated).

No critical non-EU dependencies

EU Sovereign Cloud Realm: keine expliziten/impliziten Verbindungen zu anderen Realms (stated).

Ownership / ultimate parent (EU-owned?)

Oracle (US) – EU Sovereign Cloud wird ueber EU legal entities betrieben, aber ultimate parent non-EU (stated).

Controlling interest & FISA 702 risk (jurisdiction ≠ residency)

Ultimate Parent: Oracle Corporation (US). Auch bei EU-Residency/Realm bleibt US-Jurisdiktion als Risiko-Faktor (FISA 702 / CLOUD Act) grundsätzlich relevant.

Local contracting entity & EU governance (operational model)

EU Sovereign Cloud realm: Operators EU residents, employed by EU legal entity; EU governance committee (stated).

Independent advisory board

EU Governance Committee fuer EU Sovereign Cloud (stated).

EU root CA / trust services

Separater kryptographischer Realm. Aber: Root CA / Trust Services nicht explizit als EU-basiert dokumentiert.

BSI C5

EU Sovereign Cloud: Einbindung in Audit-Programme inkl. BSI C5 (stated; nach Abschluss der Audits).

ISO 27001 / ISMS

Oracle Cloud Compliance Programme (ISO 27001 u.a.) – EU SC: align/extend je Scope (stated).

IT-Grundschutz (BSI)

US-Unternehmen (Oracle Corp.). IT-Grundschutz (BSI/deutscher Standard) nicht adressiert.

SecNumCloud (ANSSI)

N/A.

Open standards / API portability

OCI APIs/Services primaer proprietaer; Portabilitaet v.a. ueber Architektur/Container (partial).

Service portfolio depth

Aehnliche Services/Experience wie OCI Commercial (stated) – grosse Breite.

Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)

EU Sovereign Cloud: 2 Regionen (Frankfurt & Madrid) mit gegenseitiger HA/DR (stated).

Audit reports / evidence pack

Compliance-/Audit-Programme (SOC/ISO etc) kommuniziert; EU SC spezifische Evidence auf Anfrage (partial).

Policy enforcement (guardrails)

OCI: Security Zones/Cloud Guard erzwingen Security-Policies (Guardrails) dokumentiert.

Default deny / secure by default

Default Security List enthält initiale Regeln (nicht strikt 'deny-by-default'); Härtung erforderlich.

Independent verification (continuous)

EU Sovereign Cloud in Audit-Programmen (SOC/ISO etc.) genannt (periodisch); keine Continuous/maschinenlesbare Verification öffentlich belegt.

Blackbox exposure (ops/control plane)

EU Governance Committee. 150+ OCI Services transparent. Separate Realm-Architektur. EU-only Operations (EU-Bewohner, EU-Rechtseinheiten).

Operator access exclusion (workload scope)

OCI Confidential Computing (Confidential VMs) dokumentiert (Workload-Scope; TEE/verschlüsselter Memory) – geeignet zur Operator-Access-Reduktion.

IaC & automation (Terraform/OpenTofu, SDKs, APIs)

OCI hat IaC/SDK/CLI; EU SC nutzt gleiche Tools/Change Mgmt (stated).

Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)

OCI DevOps/Services: EU SC aligned mit OCI Change Mgmt (stated).

Observability (logs/metrics/traces, alerting)

OCI Monitoring/Logging typischerweise verfuegbar; EU SC aehnliche Experience (stated).

Limits/quotas (transparency & increase)

Quotas/Limits in OCI dokumentiert; EU SC vermutlich analog (partial).

Reference architectures / landing zones

Referenzarchitekturen/Best Practices in OCI Docs (partial).

Energieeffizienz / PUE & Zielwerte

Sustainability-Programm/Commitments veröffentlicht, aber keine PUE-KPIs/Targets für OCI in Quelle ausgewiesen. (Quelle: Oracle Cloud Sustainability)

CO₂-/Wasser-Reporting + erneuerbare Energiequellen

Renewable-Energy Commitments/Programme beschrieben; kein konsistentes Carbon/Wasser-Reporting (Scopes/WUE) in Quelle. (Quelle: Oracle Cloud Sustainability)

Service catalog (core/security)

Expand to load the service catalog …