AWS European Sovereign Cloud Compliance

The AWS European Sovereign Cloud compliance programme helps customers to understand the robust controls in place within the AWS European Sovereign Cloud to maintain security and compliance. The AWS European Sovereign Cloud is designed to help public sector and regulated industry customers in Europe to host sensitive data and critical workloads while meeting stringent data residency and operational autonomy requirements. 

The AWS European Sovereign Cloud: Sovereign Reference Framework (ESC-SRF) aligns sovereignty criteria across key domains including governance independence, operational control, data residency and technical isolation, providing a structured foundation for compliance programmes. This enables customers with enhanced sovereignty requirements to establish and operate within a secure, compliant AWS control environment designed specifically to meet stringent European Union digital sovereignty standards. 

We include generally available AWS European Sovereign Cloud services in our compliance scope based on expected use cases, customer feedback and demand. Services not currently listed in scope can still be used within the sovereign cloud environment. Under the Shared Responsibility Model, your organisation must assess whether a service will process or store customer data and evaluate its impact on your compliance posture within the data residency and operational autonomy framework of the AWS European Sovereign Cloud.

This section provides a list of AWS services in scope of AWS European Sovereign Cloud assurance programmes. Unless specifically excluded, generally available features of each of the services deployed in the AWS European Sovereign Cloud are considered in scope of the assurance programmes, and are reviewed and tested at the next opportunity for assessment. Refer to the AWS Documentation for the features of an AWS service available in the European Sovereign Cloud.