Guides / EU region vs digital sovereignty on AWS: where Django Cloud fits
Peter van Doorn
EU region vs digital sovereignty on AWS: where Django Cloud fits
"Our data is in an EU region" is true and also not the whole story. A region says where data is stored. It does not say who can be compelled to hand it over. If a client sells or buys "digital sovereignty", you need to know the difference. This guide is general information, not legal advice.
Three different questions
- Residency: in which country is the data stored?
- Jurisdiction: whose laws can force the provider to disclose it?
- Operational control: who can access the systems, and from where?
An EU region answers the first one. The other two depend on the company that runs the cloud.
What an EU region on AWS gives you
- Data stored in European data centres, with the provider's controls and certifications.
- A simple answer for GDPR transfer questions: the data does not leave the EU.
- Strong technical isolation between customer accounts.
What it does not give you
- AWS is a company headquartered in the United States. US laws such as the CLOUD Act can apply to US providers for data under their control, including data stored in Europe.
- Support and operations staff may be located outside the EU.
- It does not stop you from sending data elsewhere by accident, through a US-based email, analytics or error tracking service.
Whether that risk matters depends on the data and the client. For a marketing site, rarely. For health, defence or public-sector data, often.
Options if you need more
- Encryption you control. If you hold the keys, the provider cannot read the data without you. This helps, but it also limits what a managed database can do for you.
- A European provider. A company headquartered in the EU, running its own data centres, answers the jurisdiction question differently.
- A sovereign cloud offering. AWS has built a separate European Sovereign Cloud with EU-based operation. Django Cloud does not deploy to it today.
- Self-hosting. Full control, with full responsibility.
What to tell a client honestly
Say: "Your data is stored in an EU region on AWS, in an account that you own. AWS is a US company, so US legal requests are a residual risk. We reduce it with encryption and by limiting what we send to third parties." That sentence is more credible than the word "sovereign".
Where Django Cloud fits
We run your app in the AWS region you choose, in an account that is separate from other customers'. On the Self-hosted plan that account is yours. We are a good fit for "EU storage, account you control", and not a fit for "no US-owned provider at all". See Django hosting in the EU for the details.
Or skip it
Django Cloud runs your app in the European AWS region you choose, in an account kept apart from other customers' and owned by you on Self-hosted. It is not a European-owned cloud and does not run in the AWS European Sovereign Cloud.
pip install djangocloud-cli
djangocloud deployFree plans are available for students, AWS Activate startups, open-source, non-profit and research projects. See how Django Cloud compares with other ways to host Django.
Django is a registered trademark of the Django Software Foundation. Django Cloud is not affiliated with or endorsed by it. Found a mistake in this guide? Tell us and we will fix it.