Two providers can describe their services as sovereign cloud and offer quite different arrangements. One may mean European storage. Another may also restrict administration, ownership, support access, and software dependencies.
Before comparing their claims, ask each provider to describe the exact service being offered. The answer should name the operator, locations, access arrangements, and dependencies you would be accepting.
Find the scope behind the label
If a proposal cites a qualification or audit, obtain the evidence and check its scope. Does it cover this product, these locations, and the service tier in the quote? A provider can offer several services with different arrangements.
ANSSI's SecNumCloud qualification addresses cloud-service security and protection against specified risks, including extraterritorial laws. ANSSI also makes clear that qualifying the hosting offer does not establish the security of the customer's application running on it.
BSI's C5 is a criteria catalogue used for independent attestations, not a certification issued by BSI. It should not be presented as interchangeable with SecNumCloud. Use the evidence for the question it actually answers.
Identify who operates the service
Ask which legal entity signs the contract, which entities provide infrastructure and support, and which staff can administer the environment. Include emergency access and escalation to software vendors.
A useful answer distinguishes routine access from exceptional access and explains the approval and logging process. Take questions about ownership, jurisdiction, and contractual protection to the people responsible for legal review. A diagram of European data centres will not resolve them.
For the technical side, trace a sample record through the data-flow review. It can reveal dependencies that are missing from the proposal.
Look at the services needed to keep it running
List the external systems the environment needs for identity, licences, updates, image downloads, monitoring, and backup recovery. Ask what happens if each becomes unavailable or the contract ends.
Open-source software can make it easier to inspect or replace a component. It still needs maintainers, updates, and people who can operate it. A source-code repository does not establish how your deployed service is managed.
The Anchras catalog publishes per-application Sovereignty Scores to help compare software. Use those assessments as input to a review of your own deployment. They do not replace provider due diligence or a legal assessment.
Put the exit procedure in the proposal
Ask for export formats, expected transfer time, charges, access after termination, and the procedure for deleting retained copies. Include identity configuration and application dependencies, not just the database export.
Try the procedure on a small workload before relying on it for a critical one. Record what you could move yourself and what required the provider's assistance.
These are questions to ask Anchras as well. Our control plane is hosted in the EU, and customers choose workload placement. The useful follow-up is to document how that arrangement meets the requirements of the particular service you plan to run.