Lidl's owner sells a sovereign cloud rated one level below its own claim about American law.
SEAL-4 is defined as complete EU control with no critical non-EU dependencies, and it was awarded to nobody. The exposure is still genuinely smaller than a US hyperscaler's European region, for reasons the STACKIT page does not give.
Schwarz Digits Cloud GmbH & Co. KG is a German limited partnership with seven data centres in Germany and Austria, no listed shares, and no external investors on its own account. On the question that decides most sovereignty arguments — who owns the company — that is close to the best answer available in Europe, and it is worth saying so before taking the rest apart.
The rest is a claim about law. STACKIT's explainer on the US CLOUD Act says the company is "completely European - organizationally, technically and legally", that "only operators whose corporate structure is based entirely in Europe are not bound by the CLOUD Act", and that "the management, operation and programs used are also not subject to any foreign requirements or external access rights". Those words were on the page on 11 October 2026, when it was read for this piece, and were still there on 10 November 2026.
Bram Coppens read the Commission's sovereignty framework for this desk on 16 October and set out the scale, the four awards and the weights. One line of it is the whole of this story.
The level that matches the claim was awarded to nobody
STACKIT reached the fourth of five levels. The framework describes it like this:
SEAL-3 Digital Resilience: EU law applicable and enforceable, EU actors exercising meaningful but not full influence; service, technology or operations under marginal control of non-EU third parties.
The level above reads:
SEAL-4 Full Digital Sovereignty: Technology and operations under complete EU control, subject only to EU law, with no critical non-EU dependencies.
Subject only to EU law, with no critical non-EU dependencies, is the claim on the website. It is also the level no bidder in this procedure was awarded, and the one STACKIT did not get having been assessed against the sentence."Reached SEAL-3" is the Commission's own shorthand and Bram was right to warn about it: the framework sets a minimum for each of eight objectives, not one level for a provider. Which minimum applied where in this tender is in a specification this desk has not read, so what STACKIT scored on legal and jurisdictional sovereignty specifically is not known here.
That is not a gotcha. It is two published sentences about one service, one written by the buyer after an assessment and one written by the seller, and only the first was tested by anybody.
Four questions, and this turns on the last one
Iris Valdés separated them on 11 September: where does the data sit, who can log in, which court can compel the company, and who owns the company.
The first is answered and verifiable. Seven data centres, Germany and Austria, three of them named on the company's own facts page. Four is the figure still in circulation, and it was right a year ago; Lübbenau was announced in November 2025 as the fifth.
The second is not answered here. Whether any administrator outside the EU holds credentials, and who holds the keys for which service, are what a DPO asks first, and neither was established for this piece.
The third has no clean answer. The provision Iris read reaches data in a covered provider's possession, custody or control, and it is indifferent to where the disk is. A US court would need an entity in front of it that both counts as a provider and can in practice obtain the material.
The fourth is where this lands, and it is where STACKIT is strongest. No US parent. No listed equity for an American order to reach through. No fund with American limited partners holding a consent right over a change of control. A German foundation structure over a German limited partnership is a materially different exposure from a European subsidiary of a Washington-state corporation, and anybody telling a procurement committee otherwise is selling something too.
So the conclusion mostly holds. The reasoning offered for it does not, and the reasoning is the part a buyer is asked to rely on.
The test the page publishes is one the group does not pass
The page says the CLOUD Act "only applies to providers based or with significant business activities in the USA". lidl.com is Lidl's American storefront, and its privacy policy is given for "Lidl US, LLC and its affiliates", which processes information in the United States. By the ordinary meaning of the words on the page, the group that owns the cloud has significant business activity in the USA.
It does not give an American court custody of a German customer's workload, and this desk will not pretend it does. A supermarket company is not a remote computing service and does not hold the data. The point is narrower and worse: the test as published is a group-level test, and at group level the group fails it.
The same goes for a corporate structure "based entirely in Europe". XM Cyber, which CrowdStrike's release of 16 July 2026 calls a Schwarz Digits company, is reported by Calcalist and by ITPro to be an Israeli business headquartered in Tel Aviv, bought in 2021. It sits in the same division as the cloud.
Neither fact changes the verdict. Both show that the sentences doing the reassuring were drafted for a brochure rather than a tender, and under the framework that is not cosmetic: the contracting authority sets a level by weighing contributing factors, and material weaknesses in one or more of them lower it.
A security platform that patches itself from Austin
CrowdStrike is acquiring XM Cyber's intellectual property, "including more than 45 patents and proprietary source code", and taking no revenue and no customers. XM Cyber carries on as a standalone business "with an intellectual property license from CrowdStrike". And: "A phased roadmap will deliver Falcon on STACKIT."
Set that beside three of the framework's own questions. Legal and jurisdictional sovereignty asks where intellectual property is created, registered and developed, EU against third countries. Supply chain asks where and by whom software is architected and programmed, and which jurisdiction governs its packaging, distribution and updates. Security and compliance asks about the ability to develop, test and apply security patches independently of non-EU vendors.
Patents and source code written in Israel inside a German group now belong to a Nasdaq-listed Texas company, which licences them back. An endpoint agent that runs at kernel privilege and takes content updates from Austin is on a published roadmap to the sovereign platform. Anyone who spent 19 July 2024 on a bridge call can describe what a vendor content update does to a fleet, and can also tell you that the recommendation afterwards was to stage updates, and that the recommendation was written down.
A rating is a photograph. The only thing that re-runs the assessment is another tender.
The award was April. The IP sale and the roadmap are July. Nothing in the procedure re-opens a level because the thing it measured changed four months later, and nothing in the marketing has to change either.
The numbers that exist, and the one that does not
Schwarz Digits' release of 17 November 2025 gives Lübbenau a total investment volume of 11 billion euro, an initial connected load of around 200 megawatts, three modules by the end of 2027, and room for up to 100,000 GPUs in future. dpa reported, on company information, that 2.5 billion of that is construction and the rest IT infrastructure, which puts the technology spend at 8.5 billion by subtraction from a wire report. No Schwarz Digits publication read here names a chip, accelerator or hardware vendor. The framework's technology objective asks about EU independence in processors and accelerators, and 100,000 of something has to be bought from somebody.
The group published 185.6 billion euro of revenue for financial year 2025 and 2.2 billion for Schwarz Digits, up 15.8 per cent. Neither is a cloud number, and the group page does not name STACKIT in a sentence. No STACKIT revenue and no customer count has been published anywhere this desk could find. Manager Magazin has reported 46.5 million euro of STACKIT cloud revenue in financial year 2025/26 against 177.3 million planned. That is attributed and nothing above rests on it, but if the order of magnitude is right, a framework worth up to 180 million over six years is a large share of the external business, which is worth knowing when a supplier fills in a sovereignty questionnaire.
No question in this piece was put to STACKIT or to Schwarz Digits. Everything attributed to them is quoted from material they published themselves, and the questions a buyer would actually ask — who holds the keys, who administers the platform from where, what the Falcon update path looks like — are unanswered because they were not asked.
Two current pages that cannot both stay current
The CLOUD Act explainer says server locations are exclusively in Germany and Austria. The release of 28 May 2026 says the KPN service will be hosted in KPN's data centres in the Netherlands, available by mid 2027. Both pages were live on 11 October 2026, and the release does not say where that service runs in the meantime.
One of those two sentences has to move before mid-2027. The one that gets quoted in procurement documents is the other one.
Written from
Primary The document itself. Claims in this piece rest only on these.
- Cloud Sovereignty Framework, version 1.2.1, October 2025Downloaded and read in full, all six pages. Source for: the eight Sovereignty Objectives SOV-1 to SOV-8 and their descriptions, quoted here in the document's own words; the five SEAL definitions, likewise quoted rather than paraphrased, because the paraphrases in circulation are softer than the text; the statement that the tender specification defines the minimum assurance level of each objective rather than one level overall; the contributing factors listed under each objective, including the naming of the US CLOUD Act and the Chinese Cybersecurity Law under SOV-2 and the kill-switch factor under SOV-1; the full weighting table and its total; the stated reason for weighting SOV-2 and SOV-7 lower; and the scoring formula. The document also names its own antecedents — CIGREF's Trusted Cloud Referential v2, Gaia-X, ENISA, NIS2, DORA, France's Cloud de Confiance, Germany's Souveräner Cloud — which is the sentence that tells you what it is.
- Commission advances cloud sovereignty through strategic procurement, 17 April 2026Read in full. Source for: the tender's launch in October 2025; the four awards and the stated reason for making four; the named providers and consortium members, reproduced here exactly as the Commission spells them; the eligibility floor of SEAL-2; the attribution of SEAL-3 to Post Telecom with CleverCloud and OVHcloud, to STACKIT and to Scaleway, and of SEAL-2 to Proximus with S3NS; the sentence about Google Cloud technology exclusively operated by EU companies; the claim that non-European technologies operated within a strict framework can meet the minimum; the promise of an updated framework version; and the invitation to other organisations to use the approach. This page does not state a contract value, which is why no figure appears in the body.
- CLOUD Act and STACKIT, vendor explainerRead on 11 October 2026 and quoted verbatim for the four claims this piece turns on: 'STACKIT is completely European - organizationally, technically and legally'; 'only operators whose corporate structure is based entirely in Europe are not bound by the CLOUD Act'; 'The management, operation and programs used are also not subject to any foreign requirements or external access rights'; and 'the CLOUD Act only applies to providers based or with significant business activities in the USA'. Primary for what the company claims, which is the only thing it is cited for. It is not cited for any proposition of American law, and it gives no statutory citation of its own. This is an observational source and it decays: the page is one edit away from saying something else, which is the reason the reading date is in the body as well as here. Re-checked 10 November 2026: all four quotations are on the page word for word, as is the statement that server locations are exclusively in Germany and Austria.
- Data sovereignty with STACKIT, product pageRead on 11 October 2026. Quoted for 'Our companies, data centers and servers are located exclusively in Europe', for the statement that there are no changes of ownership through which third parties — the page names acquirers and creditors — could reach customer data, and for the claim that data traffic cannot be paralysed by sanctions or shutdowns. The page does not mention subprocessors, which is a negative finding rather than an omission on our part: it was looked for. Re-checked 10 November 2026: the quoted sentence and the ownership and sanctions statements are unchanged, and the page still does not mention subprocessors.
- STACKIT facts and company informationRead on 11 October 2026. Source for the legal entity Schwarz Digits Cloud GmbH & Co. KG, renamed in 2026 from STACKIT GmbH & Co. KG; the seven European data centres in Germany and Austria with more under construction, of which three are named (DC01 Neckarsulm, DC08 Ellhofen, DC10 Ostermiething); the headquarters at Bad Friedrichshall; the statement that the company is independent of external investors; the certification list including BSI C5 Type 2; and the naming of the European Commission, the German digital ministry, KPN and the Dutch government among reference customers. No revenue figure and no customer count appear on it. Re-checked 10 November 2026: entity, seven data centres with the same three named, headquarters, investor statement, BSI C5 Type 2 and the reference customers are unchanged, and there is still no revenue figure or customer count.
- CrowdStrike and Schwarz Digits expand strategic partnership to deliver sovereign cybersecurity across Europe, 16 July 2026Read in full. Source and quoted verbatim for the Austin and Bad Friedrichshall dateline; the acquisition of XM Cyber's intellectual property 'including more than 45 patents and proprietary source code', with no revenue or customers acquired; XM Cyber continuing as a standalone business 'with an intellectual property license from CrowdStrike'; the sentence 'A phased roadmap will deliver Falcon on STACKIT'; the description of XM Cyber as a Schwarz Digits company; and the expected close in the second half of CrowdStrike's fiscal 2027 subject to regulatory approvals. The licence terms are not described in the release and are not characterised here.
- Ground-breaking ceremony in Lübbenau, 17 November 2025Read in full. Source for 'a total investment volume of 11 billion euros', the initial connected load of around 200 megawatts, the statement that up to 100,000 GPUs could be installed in future, the first construction phase of three modules due by the end of 2027, and the description of the site as STACKIT's fifth data centre. The release names no chip, accelerator or hardware vendor anywhere, which is the point made in the body. It gives no split of the investment figure.
- KPN and Schwarz Digits launch European sovereign cloud for the Netherlands, 28 May 2026Read in full, from the Rotterdam/Neckarsulm dateline onwards. Source for the hosting of the service in KPN's data centres in the Netherlands, the division of roles between KPN and STACKIT, availability 'by mid 2027', and the sentence 'The service operates under European jurisdiction.' Checked and absent: the release does not say where the service runs before the Dutch facilities are in use. Trade coverage asserts an answer to that; it is not printed here.
- Fiscal year 2025, group figuresRead on 11 October 2026. Source for group revenue of 185.6 billion euro, 604,000 employees, 34 country locations, and 'Revenue at Schwarz Digits grew to 2.2 billion euros (+15.8 percent; previous year: 1.9 billion euros)', quoted here. The page does not name STACKIT in any sentence and attributes no part of the Schwarz Digits figure to it.
- Lidl US privacy policy, and lidl.comRead on 11 October 2026. lidl.com is Lidl's United States storefront and identifies itself as such; its privacy policy is given for 'Lidl US, LLC and its affiliates' and states that information obtained will be processed in the United States or other jurisdictions. Cited for one narrow fact only: that the group which owns the cloud entity operates a United States legal entity and a retail business there. The body says in terms what that does and does not do under the CLOUD Act, and nothing here should be edited into a claim that a US court can reach STACKIT customer data through it.
- The CLOUD Act reaches data by custody, not by location, 11 September 2026Read in full, including its sources block, before this piece was written. The four-question test applied in the second half of this piece is hers and is credited as such. The operative American words — possession, custody, or control — are quoted from her reading of the provision, not from a fresh reading of the United States Code by this desk, and the body does not state a section number for that reason.
- Nobody reached the top of the EU's sovereignty scale, 16 October 2026Read in full. The scale, the award, the weighting and the per-objective point are his, established there, and this piece deliberately does not re-explain them. His open question — which minimum the Commission set for each objective in this tender — remains open and is restated here as still open rather than quietly dropped.
- The ownership chain from the foundation to the cloud entityNot established. That the Schwarz Group sits under the Dieter Schwarz Stiftung is widely stated, including in commentary giving the foundation a 99.9 per cent interest in a holding company, and none of that was traced to a commercial register for this piece. What is used in the body is narrower and does rest on company sources: the cloud entity is a German GmbH & Co. KG, and STACKIT's own facts page says it is independent of external investors. A buyer who needs the chain itself needs the Handelsregister extracts, not this article.
- Administrative access, key custody, and STACKIT's SOV-2 levelNot established, and all three matter. Whether any personnel outside the EU hold administrative access to the platform, who holds the cryptographic keys for which service, and what minimum the Commission set for SOV-2 in this tender are the three questions a reader would most want answered, and this desk answered none of them. The second is a contractual and architectural question per service; the third is in the tender specification, which was not read. The body says so.
- Contact with STACKIT or Schwarz DigitsNone made. No question in this piece was put to either company, no comment was sought on the CLOUD Act page, the Falcon roadmap or the XM Cyber licence, and nothing here reflects a response because none was invited. The body carries this as a limitation rather than leaving it to the sources block. Everything attributed to the companies is quoted from material they published themselves.
- The BSI cooperation, and the accelerator vendorNeither established, and both were looked for. A cooperation between the Federal Office for Information Security and Schwarz Digits on sovereign cloud for the federal administration is reported in German trade press, dated by one site to March 2025, and no release from the BSI or from Schwarz Digits was found; it is therefore absent from the body. No hardware, chip or accelerator supplier is named in any Schwarz Digits publication read here, which is why the body says the vendor is not named rather than naming one.
Reporting Attributed, not relied on. Where the reporting is the fact, it says so.
- The Lübbenau investment split, and STACKIT's cloud revenueAttributed in the body and not relied on. dpa reported, on company information, that 2.5 billion euro of the Lübbenau total goes into construction and the remainder into IT infrastructure; Schwarz Digits' own release gives no split, so the 8.5 billion remainder is arithmetic on a wire report and is described as such. Manager Magazin, on internal documents and company sources, reported STACKIT cloud revenue of 46.5 million euro in financial year 2025/26, 177.3 million euro planned for the current year, and more than 90 per cent of Schwarz Digits revenue coming from inside the group. Neither figure is confirmed by the company and neither is stated in this publication's own voice.
- XM Cyber's Israeli origin and the 2021 purchaseAttributed. Both report XM Cyber as an Israeli company headquartered in Tel Aviv and acquired by the Schwarz Group in 2021, Calcalist putting the price at 700 million dollars; the two differ on whether Schwarz acquired all of it or a majority, so no ownership percentage is printed. CrowdStrike's own release is the source for XM Cyber being a Schwarz Digits company today. xmcyber.com's about page returned a 404 when it was tried for this piece, so the company's own statement of its headquarters was not obtained.