A sovereign cloud builder designs and ships a substantively sovereign cloud product for regulated markets, going beyond regional data residency to deliver opt-in volume encryption at rest (LINSTOR and LUKS) with a passphrase you hold and a key-management process designed with you, supplier-chain transparency, audit logs with configurable retention, and an air-gap deployment option. It serves national and regional government IT services, telcos launching sovereign-cloud product lines, regional operators in jurisdictions with sovereignty mandates, and quasi-public entities. Ænix builds these products on Cozystack, an open-source Apache 2.0 CNCF project that runs virtual machines via KubeVirt and containers on a single Kubernetes API, with Cilium eBPF networking, LINSTOR/DRBD storage, and Tenant CRD multi-tenancy. Because the foundation is open source with no phone-home telemetry, the resulting product can demonstrate transparency and regulator-aligned operations that hyperscaler “sovereign” regions cannot match substantively.
Sovereign cloud is a procurement-mandated reality in 2026 across EU member states, Kazakhstan, and several APAC jurisdictions. Building one means designing for substantive sovereignty — not just marketing claims — including encryption-key custody, supplier-chain transparency, audit-readiness, and regulator-aligned operational model.
Ænix builds sovereign cloud products on Cozystack for governments, quasi-public entities, and regional operators serving sovereignty-mandated markets.
Pairs with: Ænix Private Cloud Platform for sovereign clouds that need opt-in volume encryption with a passphrase you hold and air-gap support; Public Cloud Platform for large sovereign-cloud product launches at hyperscaler-adjacent scale.
Who builds a sovereign cloud product
- National / regional government IT services offering shared sovereign cloud
- Telcos launching sovereign-cloud product line
- Regional operators in jurisdictions with explicit sovereignty mandates
- Quasi-public entities (transport, energy, banking-adjacent) building sectoral sovereign cloud
What sovereign cloud actually requires
Beyond regional residency:
- Documented encryption-key custody — who holds the keys, rotation, emergency access
- Open-source platform foundation — for transparency and audit-readiness
- Supplier-chain transparency to second hop minimum
- Air-gap deployment option for the most sensitive workloads
- Audit-trail completeness in regulator-consumable formats
- No phone-home telemetry — opt-in only
These are the properties a sovereign-cloud product has to demonstrate. Ænix designs them with you during the build; the platform’s current encryption and logging mechanics are documented on the compliance evidence pages.
Engagement structure
Discovery + procurement-readinessBSI C5SecNumCloudEUCS
scopes
Ænix sovereign cloud buildSovereignty controlsProcurement-ready docs
delivered on
Cozystack platformKubeVirt VMsContainersOne Kubernetes API
runs on
Customer hardware / jurisdictionAir-gap optionOpt-in volume encryption
- Discovery call (30 minutes, free) and readiness assessment (14 or 28 days, fixed price), with procurement readiness in scope
- Pilot (3-6 months), then build (9-18 months to full multi-region production) — platform, sovereignty controls and procurement-ready documentation
- Managed operation (optional)
For specific sovereign-cloud requirements (BSI C5, SecNumCloud, EUCS) — discussed during discovery.
Procurement readiness
Ænix accepts RFI / RFP through:
- EU member states — TED, national e-procurement portals
- Kazakhstan — goszakup.gov.kz, mitwork.kz, zakup.sk.kz, Unified Procurement Platform
- Other jurisdictions — discussed per case
Ænix created Cozystack, a CNCF project and CNCF Certified Kubernetes distribution, and maintains it with maintainers from other companies. Ænix sells three platforms built on it — Public Cloud, Private Cloud and AI — plus support and services.
Frequently asked questions
What makes a cloud substantively sovereign rather than just regionally hosted?
Beyond data residency, substantive sovereignty requires documented encryption-key custody (who holds the keys, rotation, emergency access), an open-source platform foundation for audit-readiness, supplier-chain transparency to at least the second hop, an air-gap deployment option, complete regulator-consumable audit trails, and no phone-home telemetry.
Why build a sovereign cloud on Cozystack instead of a hyperscaler sovereign region?
Cozystack is open source under Apache 2.0, so the platform can be inspected and audited end to end, runs with no mandatory phone-home telemetry, and supports air-gap deployment. Hyperscaler sovereign regions cannot match these transparency and custody properties substantively because their control planes remain proprietary.
Who typically engages Ænix to build a sovereign cloud product?
National and regional government IT services offering shared sovereign cloud, telcos launching a sovereign-cloud product line, regional operators in jurisdictions with explicit sovereignty mandates, and quasi-public entities in transport, energy, and banking-adjacent sectors building sectoral sovereign clouds.
How long does a sovereign cloud build take?
Engagements start with a discovery call and a 14- or 28-day readiness assessment. National and multi-region programmes then run a 3-6 month pilot, followed by 9-18 months to full multi-region production, covering the platform, sovereignty controls and procurement-ready documentation. Managed operation afterwards is optional.
Which sovereignty frameworks and procurement channels are supported?
Specific requirements such as BSI C5, SecNumCloud, and EUCS are addressed during discovery. Ænix accepts RFI/RFP through EU TED and national e-procurement portals, and through Kazakhstan platforms including goszakup.gov.kz, mitwork.kz, zakup.sk.kz, and the Unified Procurement Platform; other jurisdictions are handled per case.
What is the technical foundation of the platform?
The product is built on Cozystack, which runs virtual machines via KubeVirt and containers on a single Kubernetes API, with Cilium eBPF networking, LINSTOR/DRBD storage, and Tenant CRD multi-tenancy. Air-gapped installation is part of open-source Cozystack; Ænix supports it from the Plus tier.
