Veeam opens global sovereignty programme for service providers, with ThinkOn among first recognised

Veeam Software has launched a global programme that will certify local service providers on their ability to keep customer data under national control. The move puts one of the largest data protection vendors, which says it serves more than 550,000 customers including 80% of the Fortune 500, into a market where Gartner expects sovereign cloud infrastructure spending to reach $80.4bn this year.

The Veeam Sovereign Service Providers Program begins with a Data Sovereignty Competency inside the Veeam Cloud & Service Provider (VCSP) programme. Only providers that meet its requirements will qualify, and more offerings are planned for later this year.

To qualify, providers must show evidence covering local operating models, jurisdictional controls, in-region personnel, data governance processes, customer oversight and resilient data protection. Canadian provider ThinkOn is among those recognised at launch. Customers will find approved providers through Veeam partner profiles that list sovereignty capabilities, regional coverage and competency status. The split of responsibility is deliberate: Veeam supplies the technical foundation, and partners contribute the local operation, governance and legal knowledge that the technology alone cannot provide.

“Sovereignty is defined by each customer’s regional government, legal, regulatory and operational requirements. Meeting those requirements depends on both technology and the way a service is operated,” said Michelle Graff, Senior Vice President, Global Partnerships at Veeam. “The VCSP Data Sovereignty Competency gives customers a clearer way to identify providers that have invested in both.”

Recovery copies carry the same legal exposure

The sovereignty debate has mostly centred on where primary workloads run. A backup is a full second copy of an organisation’s most sensitive records, such as patient files, payroll data and customer histories, and the rules on residency, access and jurisdiction apply to that copy as much as to the original. Veeam’s programme asks customers to assess providers on four dimensions: data location, operational control, access governance and legal jurisdiction, while keeping recoverability intact.

“Digital sovereignty is transitioning into a critical board-level imperative, with its urgency escalating as continued geopolitical events increasingly weaponise access to global infrastructure, services and AI. If you lack comprehensive control over your technology stack, a single geopolitical action can terminate your business operations overnight,” according to Gartner’s Hype Cycle for Digital Sovereignty, 2026, which Veeam cited in its announcement.

The risk is already showing up in incident data. A July 2026 Kiteworks survey of 286 data governance, security and compliance professionals across Europe, the Middle East and Canada found that 33% had experienced a sovereignty-related incident in the previous 12 months. The rate was highest in the Middle East at 44%, followed by Europe at 32% and Canada at 23%. Third-party compliance failures accounted for 17% of incidents, unauthorised cross-border transfers 12% and government data access requests 10%. Those are the failure points a provider certification is designed to address.

Veeam’s own research found that 70% of organisations admit AI workflows are interacting with sensitive corporate data without full oversight, and 67% report employees creating autonomous AI workflows that IT teams cannot fully track. Data that once sat in known systems now moves through tools governance teams may not know exist, making it harder to answer, with confidence, where it lives and who can reach it.

“Across Europe, sovereignty has evolved from a compliance consideration into a strategic business requirement,” said Tim Pfaelzer, General Manager and Senior Vice President, EMEA at Veeam. “As regulation expands and organisations scale AI initiatives, they need greater certainty over where data resides, who can access it and which laws govern its use. Veeam’s technology, combined with the local operating capabilities of trusted service providers, gives customers a practical and defensible route to strengthen data control without sacrificing resilience or recovery.”

Money is moving toward local operators

Gartner forecasts worldwide sovereign cloud infrastructure-as-a-service spending will rise 35.6% to $80.4bn in 2026 and reach $110.6bn in 2027. The fastest growth is outside the two largest markets: spending in the Middle East and Africa is forecast to grow 89% this year, mature Asia Pacific 87% and Europe 83%, with Europe on course to overtake North America in 2027. Gartner expects 20% of current workloads to move from global to local cloud providers.

“As geopolitical tensions rise, organisations outside the US and China are investing more in sovereign cloud IaaS,” said Rene Buest, Senior Director Analyst at Gartner. He added: “To compete for local customers’ cloud business, large cloud providers must seriously acknowledge the sovereignty concerns.” A separate Gartner survey of 241 CIOs and IT leaders in Western Europe found 61% wanted to increase their use of local cloud providers, and 53% said geopolitics would restrict their future use of global providers.

The hyperscalers have responded at scale. AWS made its European Sovereign Cloud generally available in January 2026, with its first region in Brandenburg, Germany, operated exclusively by EU residents and backed by a planned investment of more than €7.8bn. Veeam’s model takes another route, giving independent regional providers a recognised credential so they can compete for regulated customers on local control and jurisdictional expertise.

“Sovereignty isn’t a checkbox. It is proof of jurisdiction, residency and control, verified end to end,” said Ahsan Khan, Chief Technology Officer at ThinkOn. “This recognition reflects the standard we set in Canada’s most regulated environments, and it is the same discipline guiding how we build for regulated customers across every market we serve.”

A credential still leaves the hard work to customers

Veeam states that the competency recognises provider capabilities against its own programme requirements and does not replace a customer’s legal, regulatory, risk or compliance assessment. Organisations will still need their own advisers to decide whether a certified provider meets the rules in each jurisdiction where they operate. The wider programme is also unfinished: Veeam has said it will launch further offerings later this year, with details to come once they are ready for market.

“Full independence from global tech vendors will take several years of ongoing effort and investments by local providers,” Buest said in an earlier assessment of European cloud strategy. The scale of the shift remains contested. IDC data cited by Kiteworks shows that only 4% of European organisations plan to stop using global public cloud vendors and rely solely on local providers, which suggests most enterprises will run mixed estates and need sovereignty controls across both.

For smaller businesses, the problem often starts with knowing what they already have. A 2025 survey of 2,000 European SMEs by team.blue found that 57% did not know whether their cloud provider guaranteed EU-only storage. The Kiteworks study found that 59% of respondents cited technical infrastructure changes as their biggest sovereignty burden, ahead of legal and compliance expertise at 53%. A searchable list of providers with verified capabilities could shorten that discovery work, and its value will depend on how rigorously Veeam enforces the criteria as the list grows.