Sovereignty is a construction, not a checkbox.

What we run, and at which layer we start

Rytiv runs on dedicated bare metal in the European Union, operated by us from Germany; the first region is Amsterdam. The machines, the databases, the object storage layer, the edge and the control plane are ours: we rent metal, network and offsite backup space in the EU and build everything above that line ourselves.

The layer is the whole claim, so here it is precisely. We rent bare metal, the same way almost everyone in Europe does, and we say so. What we do not do is rent a platform and put our logo on it. Your app is not a container on somebody else's managed runtime: it is a virtual machine with its own kernel, scheduled by our control plane, on a machine whose whole memory we booked. That is why we can tell you what a deploy costs, why an idle app can hand its memory back, and why nobody between us and the metal can change those answers.

The distinction matters because "sovereign" is usually claimed one layer too high. The full subprocessor list is part of our data processing agreement.

Why an EU data centre is not the same as EU jurisdiction

The question is not where the servers stand. It is which government can compel the company that operates them. A US provider with a data centre in Frankfurt is still a US company, and the CLOUD Act reaches its data wherever it sits. This is the point the Court of Justice made in Schrems II when it struck down the Privacy Shield: contractual promises do not bind a foreign state, and data residency alone is not a legal shield.

Rytiv is a service of Spektal GmbH, incorporated in Germany and entered in the commercial register at Amtsgericht Oldenburg. Details are in the imprint; the operating entity, the hardware and your apps, databases and files are all inside the European Union.

Why this matters

On 10 June 2025, testifying under oath before a French Senate committee of inquiry, the Director of Public and Legal Affairs of Microsoft France was asked whether he could guarantee that French public sector data held by his company would never be handed over on a US government order without French consent. His answer: "No, I cannot guarantee that", adding that it had never yet happened. Source: senat.fr, compte-rendu of 9 June 2025.

In May 2025 the International Criminal Court's chief prosecutor, sanctioned by US executive order, lost the Microsoft-hosted email address he worked from and moved to a Swiss provider. Microsoft states it never suspended services to the court, and confirms it was in touch throughout the process that disconnected the sanctioned official. Who flipped the switch is contested; that the account went dark by decree rather than by incident is not.

37 percent of German companies would use a cloud that keeps their data in Germany and shielded from foreign access, even at the price of fewer features or higher cost, up from 27 percent a year earlier. 58 percent still rule it out. Source: Bitkom Cloud Report 2026, 603 companies.

The default is Europe

The EU is where your workloads run, always. An optional feature that runs elsewhere, like the assistant in the console, is opt-in and labelled where you use it. We would rather offer something and name where it runs than hope nobody reads the list, and the list of recipients is on our privacy page.