How to recognize sovereign solutions
The fundament holds, but sovereignty becomes visible one level up. Where platforms and solutions are in use. A sovereign infrastructure is of little use if the software mirrors data into a third-country cloud or outsources functions to opaque services. That is why the three test questions from part 2 also apply to every single solution: Where is the data being processed, including telemetry and metadata? Who operates it? And which legal system does the provider fall under? At the solution level, three further criteria come into play: transparency instead of a black box, responsibility from a single source and a sovereign delivery and service model.
IT security at the heart: "by design" instead of "by checkbox"
Among all solution categories, IT security is the most sensitive and at the same time the most paradoxical. Almost every company protects itself with technologies over which it has no control of its own, usually with non-European software, operated in some cloud or other. Every decision made there, whether political, economic or simply in the release calendar, has a say in your own security. Yet security solutions in particular see everything: identities, data traffic, vulnerabilities, incidents, anomalies and so on. A security stack that outsources its analysis to a foreign cloud undermines the very control it is meant to protect.
Sovereign security therefore works "by design" instead of "by checkbox". Most providers say: "Trust us!" Sovereign solutions, on the other hand, say: "See for yourself!" They disclose which data they collect, where it is processed and what the licensing and operating model really contains. Source code, roadmap and operations are traceable. The entire design is in European hands and subject to European law. Only then does IT security not just protect against attackers but also preserve data sovereignty.
One role is not enough: responsibility from a single source
Even the best solution remains piecemeal if the responsibility behind it is fragmented. Digital sovereignty cannot simply be bought. Delivery, operations, data, technology and strategy: if one of these is missing, even sovereign services become nothing more than a promise.
This is exactly where things fail in practice: a reseller controls delivery but not the technology. A hoster controls operations but not the strategy. What remains is a patchwork in which no one can say without gaps who is accountable for data, operations and legal matters at which point. Operationally, sovereignty only becomes complete when four roles come together under one roof: manufacturer, reseller, operator and consultant, from a single source, with a single point of responsibility. This is not an argument about size but about control.
Delivery and service model: sovereignty must be operable
A solution can be sovereign on paper and dependent in practice, depending on how it is delivered and operated. On-premises, private cloud or managed service: each model shifts control differently. This applies especially to managed and as-a-service offerings. They deliver what internal teams urgently need: flexibility, scalability and relief. But whoever operates a service also touches the data flowing through it: configurations, incidents, ticket histories. The way out lies not in doing without but in the origin. If location, operations and legal system are entirely within the EU, responsibility is delegated in the best sense without giving up control.
In everyday terms, this means: transparency is not just insight but also participation. For example, when a maintenance window that does not fit the business can be rescheduled with a single click. And it means knowing who is actually working on your security: identifiable European experts instead of an anonymous chain of subcontractors. In this way, sovereignty fits into common usage models instead of creating extra work.
Conclusion: sovereignty is a chain
This brings our series full circle: from the business foundation through the fundament to the solutions and their service models. Digital sovereignty proves itself not in a single product but along the entire chain. And it is only as resilient as its weakest link. A solution is truly sovereign when it passes the test criteria at every level: location, operations and legal system, complemented by transparency, responsibility from a single source and an EU-based service model. Those who achieve this consistency instead of running isolated solutions turn the aspiration into lived practice. And they gain control, compliance and freedom of action across the entire stack.
Digital sovereignty with DTS
DTS closes this chain end to end, from the fundament to the individual platform. As a manufacturer, we develop our own security software "Made in Germany": DTS Cockpit, DTS Identity, DTS NAC and DTS Aviator are created in Germany and run in our own two certified data centers in Herford and Münster. Source code, roadmap and operations in German hands. The DTS Security Operations Center monitors around the clock under the European legal framework and with data held in Germany.
As manufacturer, reseller, operator and consultant, we combine infrastructure, managed services and our own security into an end-to-end sovereignty stack, on-premises or as-a-service, transparent and including NIS-2 compliance. The aspiration behind this is uncomfortable, even for ourselves: no blind trust, not even in DTS, but sovereignty you can verify. We develop ourselves. We operate ourselves. We take responsibility ourselves. So that in the end, only one party decides about your security: you. Europe-based by design!