Where the server is physically located matters less. What matters is who owns it. An American vendor is subject to the Cloud Act even when the data center is located in Stockholm — and it is this realization that is prompting more and more Swedish organizations to reconsider where their data actually belongs.
What is usually behind the question
The question rarely comes from the IT department first. More often, it comes from a procurement where someone has to specify where personal data is processed, from an audit requiring documented storage locations, or from a board of directors that has read about the latest legal ruling.
That’s when many discover that the answer is harder than expected. The cloud service has a data center in Europe, but the parent company is American. The subcontractors go several layers deep. And no one can say with certainty who has technical access to the information.
The difference between where data is located and who controls it
The Cloud Act gives US authorities the right to request data from American companies regardless of where the information is stored. This conflicts with GDPR‘s requirements for the protection of personal data, and that conflict hasn’t been resolved — it has merely been shifted between different frameworks since Schrems II.
Data sovereignty is therefore not about geography but about jurisdiction. A Swedish provider with Swedish ownership, Swedish data centers, and Swedish subcontractors is subject to Swedish and European law, full stop. That makes the question easy to answer in a procurement process and easy to document in an audit.
What you need to be able to answer
In which country is the information stored, and which company owns the equipment? Which subcontractors have access, and under which legislation do they operate? Can the provider demonstrate this in writing, without reservation?
If any of these answers require a lawyer to formulate, you likely have a problem to solve, not just describe.
What this question means in a procurement process
More and more public and private procurements include requirements on storage location and on being able to account for the subcontractor chain. The wording varies, but the underlying question is the same: can you certify where the information is stored and who can access it?
With a Swedish supplier, the answer becomes a single sentence instead of an appendix. It’s rarely decisive for whether you win the contract, but it removes the risk of being disqualified on a technicality.
Here’s how we do it at Savecore
All storage takes place in our own data centers in Sweden. We own the equipment, we operate it ourselves, and we are subject to Swedish law. This means the storage location can be certified without reservations.
For pure storage needs, we use Savecore S3, our object storage. For entire environments — servers, networks, and operations — we use our IaaS platform. Both can be combined with backup and disaster recovery so that even the copies stay within the same jurisdiction, which is the detail that’s often overlooked.
The path there
A migration doesn’t have to happen all at once. Most organizations start with the information that is most sensitive or most regulated — personal data, contracts, financial systems — and leave the rest in place until there’s a reason to move that too.
We review what you have, what actually needs to be moved, and in what order. Often it turns out that a small portion of the data accounts for almost all of the risk.
Frequently asked questions about Swedish data storage
Isn’t it enough that the cloud provider has data centers in the EU?
No. The Cloud Act is based on where the company is established, not where the hardware is located. A US company with servers in Frankfurt is still subject to it.
How is this different from simply encrypting the data?
Encryption protects the content, but if the provider manages the keys for you, the question remains of who can demand access to what. Encryption and jurisdiction solve different problems.
Do we have to migrate everything all at once?
No, and that is rarely advisable. Start with what is most strictly regulated or sensitive, and migrate gradually.
Your data. Swedish soil. Swedish law.
We review where your data is currently stored and what makes the most sense to migrate first.