Loading story…
Swiss public-sector data protection officers have issued a resolution urging government agencies to avoid using international software-as-a-service (SaaS) platforms, such as Microsoft 365, for sensitive data unless true end-to-end encryption is implemented. The resolution highlights that most SaaS solutions do not provide end-to-end encryption, leaving data accessible to providers and subject to foreign legal processes like the US CLOUD Act. This lack of control is seen as a significant risk to data sovereignty, as agencies cannot guarantee the confidentiality of particularly sensitive or legally protected information when using these services.
The Swiss stance reflects a broader European skepticism toward foreign-owned hyperscale cloud providers, with similar concerns raised in Germany, France, Denmark, and by the European Commission. Security analysts emphasize that true data sovereignty requires government control over encryption keys, not just data residency. The resolution also warns that SaaS providers can unilaterally change terms and conditions, further eroding security and privacy guarantees for public sector data.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Swiss public-sector data protection officers represented by Privatim issued a resolution advising government agencies not to use international SaaS platforms such as Microsoft 365 for sensitive data unless they provide true end-to-end encryption with customer-exclusive key control. The guidance cites data sovereignty and exposure to laws such as the US CLOUD Act as key concerns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourcego.theregister.com
Open sourcecio.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European companies face significant regulatory and operational risks due to heavy reliance on US-based technology and cybersecurity providers, as conflicting laws such as the US CLOUD Act and GDPR create legal uncertainty over data access and privacy. In response to these challenges and increasing regulatory demands for data sovereignty, major cloud vendors are developing new solutions tailored to European requirements. Amazon announced the AWS European Sovereign Cloud, partnering with SAP to offer platforms that allow organizations to maintain greater oversight and control over their data, aiming to address concerns from sectors like government, finance, and healthcare. These initiatives reflect a broader industry shift toward sovereign cloud solutions to mitigate geopolitical and compliance risks for European businesses.
Jun 29, 2026
European governments and organizations are intensifying efforts to achieve digital sovereignty in cloud infrastructure, driven by geopolitical uncertainties and concerns over reliance on American hyperscalers such as Microsoft, Google, and Amazon Web Services. With U.S. policy shifts and potential transatlantic tensions, European leaders are prioritizing the development of domestic alternatives and strategies to ensure control over sensitive data and critical workloads. Despite these ambitions, local cloud providers currently hold only a small share of the market, and experts suggest that a new European hyperscaler is unlikely to emerge soon, with existing players like SAP and Deutsche Telekom each controlling only about 2% of the market. In response to these sovereignty concerns, cloud providers are expanding offerings tailored to regulatory and data residency requirements. Amazon Web Services, for example, has introduced Dedicated Local Zones to provide customers with greater control over data location, security, and compliance, supporting sensitive workloads for public sector and regulated industries. These initiatives reflect a broader trend of cloud service adaptation to meet the evolving needs of European customers seeking to balance operational flexibility with strict sovereignty and compliance mandates.
Jun 29, 2026
Switzerland’s Federal Chancellery is launching a follow-up program to deploy a sovereign, browser-based open-source digital workplace alongside Microsoft 365 for personnel conducting critical government processes. The platform will provide email, calendars, document editing, file storage, collaboration, telephony, and audio/video conferencing, aiming to reduce dependence on a single cloud provider and preserve operations during outages, supply-chain incidents, or geopolitical crises. About 3,000 employees are expected to receive access by the end of 2027, supported by an initial budget of roughly CHF 9 million. The program follows the BOSS proof-of-concept feasibility study, which found the platform adequate for standard office work but identified shortcomings in large video conferences. Authorities must further address interoperability, security, identity management, performance, user support, and integration with government-specific applications before broader use. The initiative is intended to strengthen digital sovereignty, resilience, and continuity for sensitive operations, not to immediately replace Microsoft 365 across the federal administration.
Sep 14, 2026