Your infrastructure.
Your governance.
Your jurisdiction.
Soverita is a European sovereign-cloud governance platform. It installs on the infrastructure you already operate, so your clients can bring their workloads and data home.
Seven things a sovereign platform must get right.
1 · Hyperscaler parity, not just IaaS
IAM with resource-level policies, HYOK keys, S3 object storage, block storage with snapshots and backup, file shares, VPCs with route tables, security groups, private DNS, NAT and load balancers, GPU compute, metrics, logs and traces, billing and quotas, a self-service portal — the foundation services, so the operational burden doesn't land on the enterprise. Managed databases and Kubernetes follow on the same rails.
2 · Real sovereignty, not data residency
Customer-held keys in your own HSM, confidential computing, a control plane that never reaches outside for licensing, telemetry or updates, audited operator access — and an operating entity beyond the reach of extraterritorial disclosure laws.
3 · Compliance evidence built in
Policy-as-code, SBOMs, continuous reporting mapped to C5, DORA, ISO 27001, NIST CSF 2.0 and the frameworks now landing — not auditing by spreadsheet.
4 · Reversibility of the platform itself
Recent licensing shocks taught everyone that private-cloud lock-in hurts just as much. Open-source cores, open formats, a documented exit path — and Soverita never touches the substrate.
5 · GPU and AI capacity, first-class
Sovereign inference and fine-tuning are the new trigger for repatriation. GPU capacity and your AI Factory on Soverita today — your Kubernetes, your GPUs; model serving on the same governed rails. Your data never leaves the perimeter.
6 · Standard APIs where possible
S3-compatible storage, AWS-compatible IAM policy language, AWS KMS API, Terraform and CLI, OIDC/SAML federation — and bring your Kubernetes distribution and containers onto the secure infrastructure. Pipelines port with minimal rewriting.
7 · A platform your ops team wants to run
Self-service for tenants, automation for the routine — so your engineers run a stable, resilient cloud, not mundane tickets.
The gap.
Tenants are ready to pay extra for managed services — and today it comes with the additional cost of a foreign jurisdiction. Local operators have the capacity and the team to serve them. What's missing is the layer in between.
The tenants
A regional insurance broker. A bank. A health-tech SaaS. Ten developers, no SRE team. Data services are critical to their operations, and running them is neither their core business nor their expertise — they will not install Postgres themselves, configure replication, or run root-cause analysis at 3am. So they pay a hyperscaler a multiple of the self-run cost, and that price includes a jurisdiction their compliance team files under "unsolved". They would pay the same to stay home.
The providers
- You run OpenStack for clients — and regulated prospects keep dying in your security review.
- You're an MSP with a NOC, real certifications and 24/7 incident response — but no self-service, so clients wait on tickets.
- You're a telco with racks, fibre and enterprise trust in place — and no cloud product to sell over them.
The substrate runs the VMs. You have the team to support it. What's missing is identity, evidence, key custody, self-service and billing — under your brand, in your jurisdiction.
Soverita is that missing piece.
- For your tenants — a security review passes on who holds the keys and where the evidence is, not on price.
- For your board — a platform no vendor can price-shock and no foreign court can reach into.
- For your tenders — European procurement now scores sovereignty explicitly; a European-built governance layer strengthens the bid.
Same racks. Same team. A different business.
From manual operations to self-service.
Provisioning, quota changes, key rotation, evidence collection — the work that fills a NOC's day becomes self-service or automatic. Your engineers stay focused on client satisfaction.
From compliance project to platform feature.
Per-tenant keys you never hold, a tamper-evident audit chain, framework-mapped controls, support performed from inside the jurisdiction. Cost centres become the premium tier your regulated tenants pay for.
From tickets to a stable, resilient cloud.
Monitoring, billing, quotas and audit in one operator console — every tenant, every resource, one pane of glass. The governance features that let a lean team run a larger estate with more confidence, not less.
From raw infrastructure to sovereign platform.
Tenants used to AWS-level service will not go back to bare metal. Give them what they know and have grown to expect — self-service, VPCs that behave, Terraform that maps, managed services on the way — and the reason to leave disappears.
A cloud bill you can read.
Public cloud pricing is a meter on everything. The VM. Then the interface on the VM. Then the network. Then the VPN. Then every gigabyte in, every gigabyte out. Then the requests, the snapshots, the IPs, the logs. Nobody designed your bill — it accreted.
A mature business doesn't need that trade: workloads are known, growth is planned, and the elasticity premium buys variance. On your own infrastructure the economics invert — hardware you've bought, power you've contracted, a licence at one number per vCPU. No metering on traffic, no egress, no ingress, no per-request charges — from us, ever. What your tenants pay is your decision; the platform makes a flat, predictable price possible to offer. See how we price
Security you can budget.
Security is expensive when it's reactive: an incident to recover from, a breach to disclose, an auditor's finding that must be closed now — everything bought under pressure costs more and proves less. Soverita moves security from reactive to structural: controls run continuously, evidence generates itself, and security operations become planned work at planned cost.
The costly version arrives uninvited, when urgency sets the price and the specialists are already booked. And the most expensive reviewer is the regulator: they don't price the fix — they price the gap. A gap you find is a task. A gap the regulator finds is a fine. Soverita helps you identify and mitigate while it's still the first kind — posture checked every day instead of assembled for audit week, done by the team you already have.
The most sustainable server is the one you already own.
Soverita creates no refresh cycle — no appliances, no certified-hardware list, no licence tied to a new generation — so the estate you already run carries premium services it couldn't before.
Every forced hardware refresh has a carbon cost long before it has a workload. Mixed vendors, mixed generations: every rack and every watt you're already drawing produces more value. Extending asset life is the cheapest infrastructure strategy — and the most sustainable.
| DIY on-prem | Soverita on your infra | Public cloud | |
|---|---|---|---|
| Cost model | Capex + your time | Capex + one number per vCPU | Meter on everything |
| Jurisdiction | Yours | Yours | Provider's |
| Key custody | DIY, if at all | Per-tenant HYOK | Provider-managed* |
| Audit evidence | Assembled by hand | Generated, per event, per tenant | Provider's reports |
| Self-service | Tickets | Portal + API + Terraform | Yes |
| Elasticity | Buy hardware | Your capacity, instantly allocated | Yes, at the premium |
| Exit | — | Reversible adaptor, documented exit path | Egress bill & rewrite |
*or customer-managed with the provider still in the trust chain
How we price. One number per vCPU, scaled to your estate; no per-tenant fees, no revenue share. Every product and layer is priced on its own, so you pay for what's installed. Private-beta members get a discount from the standard ratecard.
Support subscription. L1/L2 your team · L3 Soverita overlay · L4 deep-tier engineering. Contractual SLA response times. Your clients never interact with Soverita.
We don't replace. We elevate.
The governance and orchestration layer installs on top of the infrastructure you already run; the substrate stays untouched. Your infrastructure team keeps running compute, your network team keeps managing switches and VLANs, your storage team keeps managing Ceph — and your OpenStack, Proxmox or OpenNebula vendor support contracts stay intact, because we don't modify, patch, or inject anything into your existing systems.
Install in steps.
Every Soverita capability is a product you can install on its own, against the infrastructure you already run. Install step by step — and stop where it makes sense for your business.
- 01 Essentials IAM · KMS (KeyRack) · Audit · CSPM · Data Perimeter — each installable alone Outcome → first governed tenant, first compliance evidence, first audit-ready environment.
- 02 Governed IaaS Compute, VPCs, block volumes, S3, load balancing Outcome → a modern cloud experience on sovereign infrastructure; tenants work the way they're used to.
- 03 Observability & self-service Metrics, logs, billing, quotas; portal, Terraform, CLI Outcome → self-service live; evidence generated as a side effect of normal operations.
- 04 Kubernetes Your distribution today; container engine, registry and managed clusters in progress Outcome → container workloads sovereign; CI/CD pipelines internal.
- 05 Data services and AI Managed databases and messaging, sovereign inference — on the same governed rails, sequenced with partners Outcome → no service-gap objection; intelligence that never leaves.
- + Plus: the Operations Center grows with you IAM and audit first, then inventory, cluster management, database monitoring and billing, inference dashboards — and, as the last step, the Agentic SOC working the findings inside your perimeter. Outcome → one pane of glass that gets richer at every stage; security operations that never sleep.
Not sure which piece is missing? The 90-minute assessment tells you where the gaps are — which products, in which order, against your infrastructure. Contact a sovereignty architect
Reversible by design.
The Connect adaptor is configured against your substrate's API with scoped, short-lived credentials — no agents on hypervisors, nothing patched, no downtime for running tenants. Every step is a layer above the one before, and the substrate stays yours. Remove the adaptor and your infrastructure continues exactly as it was; the exit path is documented.
Proven substrate keeps the workloads running. Soverita governs the surface above.
The engine room is technology the industry already trusts — OpenStack, OpenNebula, Proxmox. Soverita adds the governed surface: compute, networking, storage, object storage, file shares, observability, self-service portal and developer tooling today; container services, data services and AI in progress.
In the era of AI, isolation is not optional.
AI is part of the working team now. It writes code, runs pipelines, calls APIs, touches data — a colleague that works at machine speed, is still barely regulated, and is being learned on the job by everyone around it. A colleague like this needs a boundary.
Integration and interoperability
Teams, tools and agents work across services with one identity model and one API surface — shared where sharing is intended.
True isolation and internal guardrails
Production separate from development, departments separate from each other: network isolation, resource-level IAM permissions with immediate session revocation, a data perimeter around every tenant.
Soverita allows you to build trust circles — tenant, department, environment — each with its own identity boundary, keys and audit trail. Trust is granted per circle and enforced on every request, human or agent; every attempt across a boundary, allowed or denied, lands in the evidence chain.
Start where the impact is highest.
For cloud operators & MSPs
Expand your service. Elevate your margins. You're running infrastructure, but manual provisioning eats your team's time, no compliance evidence means regulated clients go elsewhere, and no self-service portal means your clients wait. Expand from raw IaaS to a governed sovereign platform under your brand. Regulated clients pay premium; your margins go up because your value goes up.
Start with Essentials
The first step towards sovereignty. A bank, insurer or health-SaaS prospect is sitting in your security review, blocked on key custody, audit evidence or a framework view your platform can't produce. Essentials installs in weeks above what you run today — IAM hierarchy, per-tenant HYOK keys, tamper-evident audit chain, CSPM, data perimeter — and the review re-runs on real artefacts. Standalone, no obligation to add further layers; the rest of the stack is there when your tenants ask for it.
For enterprises
One sovereign estate. Multiple departments. Complete isolation. Finance under DORA. Legal under confidentiality. R&D under trade-secret isolation. Each department an isolated tenant — its own identity, audit trail, keys, compliance posture — on one shared hardware estate, on-premises, with the developer experience your teams know. Designed for restricted-connectivity and air-gapped deployment — defence, critical national infrastructure, classified programmes.
Facing a virtualization licence renewal?
Your next platform decision should be the last one a vendor can take away from you: source escrow from signature, a reversible adaptor, an open substrate. We plan the move with you — and the substrate changes at your pace, under a governance layer that doesn't.
Nobody reaches in.
Nobody reaches in. No entity in Soverita's trust chain can be compelled by a foreign court. External access is structurally absent; the threat model we hand every evaluator shows why. Nothing leaves, either: no telemetry, no crash reports, no usage data, no licence checks reaching outside, no updates pushed in — support diagnostics are pulled through your admin path, by your consent, and every such access is itself an audited event.
The European way to scale is federation.
Many sovereign sites, each under its own jurisdiction, its own operator, its own keys — connected where their owners choose. It's the same pattern EuroHPC uses today to link Europe's supercomputing centres and AI Factories into one platform.
Regions
One operator, multiple locations — one governance plane, one catalog, one evidence base across every site you run. A tenant lands in the region their regulator requires; your team operates them all from one console.
Federation of Soverita sites
Independent deployments — different operators, different countries — able to publish services into each other's catalogs and consume capacity across sites, while identity, keys, and audit stay local to every site. The zero-trust rule scales up unchanged: isolation is the default, interconnection is a deliberate, audited act — between organisations exactly as within them.
What that unlocks: an operator in one country selling GPU capacity to another's tenants. An enterprise spanning subsidiaries across borders with no hyperscaler in the middle. Sovereign platforms that interoperate instead of fragmenting.
Why sharing the layer makes you stronger, not smaller.
A hyperscaler amortizes its platform engineering across the whole planet. A national provider building alone can't — build-your-own orchestration is expensive, error-prone, and permanently behind. Soverita changes the arithmetic: the governance and orchestration layer is shared across sovereign providers in different jurisdictions — operators who, by definition, don't compete for each other's tenants. Each keeps local exclusivity: the brand, the client relationships, the jurisdiction, the racks. What's shared is the cost and the hardening — every deployment funds and field-tests functionality that every other deployment inherits. The layer is shared; the service stays local.
That's the play for every national telco and regional provider: the racks, the fibre, the enterprise relationships and the local trust are already in place. Soverita adds the platform that turns them into IaaS and sovereign managed services — under your brand, in your jurisdiction, at a fraction of the cost and risk of building your own.
Multi-site operation is designed into Soverita's tenancy, identity and audit model; federation across deployments is on the roadmap, sequenced with our private-beta partners.
Built where privacy is law. Ready when sovereignty is required.
A European company — designed, built and operated from the EU, engineered in Sofia, Bulgaria. A published bill of materials with every component open source or EU-built, and no entity in the trust chain within reach of extraterritorial disclosure laws.
The regulatory environment has moved from narrative to procurement: DORA and NIS2 are in force, the AI Act and the Data Act arrive on dated schedules, and European tenders now score sovereignty explicitly. Soverita generates the evidence — framework views for BSI C5, DORA, ISO 27001 and NIST CSF 2.0 today, more expanding — and gets you through your audit; we are not the auditor.
Let's elevate your cloud.
Tell us about your infrastructure and what you're trying to achieve — you'll hear back within 48 hours. No commitment. No pressure.
This is a consultation, not a pitch. A sovereignty architect assesses what you run, what your tenants need, and what to improve first — on the infrastructure you already have. Nothing gets torn down; the plan builds on what works.
The private beta. A limited cohort, onboarding now: free trial for the evaluation, a discount from the standard ratecard after, and direct influence on what gets built next — your substrate and your tenants set the sequence.