Location
Cloud DevOps Consulting in Europe
We help European companies plan and implement AWS, Azure and Kubernetes infrastructure. EU GDPR applies to organisations handling the personal data of people in the EU, and we build its technical controls into our default architecture recommendations.
We can deploy to AWS eu-central-1 (Frankfurt) as a primary European region, with eu-west-3 (Paris) and eu-north-1 (Stockholm) where specific country data residency is needed. Azure West Europe (Netherlands) and North Europe (Ireland) serve Microsoft-stack clients.
EU GDPR technical controls
GDPR requires data minimisation, purpose limitation, integrity and confidentiality (Article 5), and technical and organisational measures (Article 32). We can implement:
- Where you want EU-only storage, data residency enforcement via AWS SCPs (deny all non-EU regions) or Azure Policy
- Encryption at rest (KMS customer-managed keys, Azure Key Vault) and in transit (TLS 1.2+)
- Access logging for all personal data stores with retention aligned to your retention schedule
- Data Subject Access Request (DSAR) tooling for locate, export, and delete workflows
- Privacy-by-design: default-deny network policies, minimal IAM permissions, database column-level encryption for sensitive fields
DORA (Digital Operational Resilience Act)
DORA (EU Regulation 2022/2554) applies to financial entities in the EU, and indirectly to their ICT service providers, from 17 January 2025. It mandates ICT risk management, incident classification and reporting, resilience testing, and third-party ICT risk management. We can help financial entities implement technical controls that support DORA requirements:
- ICT risk register with documented control evidence
- Incident response playbooks with DORA-aligned classification (major vs. non-major)
- Threat-led penetration testing (TLPT) readiness, infrastructure hardening before your TLPT exercise
- Third-party ICT vendor monitoring (cloud provider status, contractual SLAs)
DORA compliance requires legal and regulatory expertise beyond technical controls. Engage a qualified legal counsel and compliance officer alongside our technical work.
AWS regions for European clients
eu-central-1(Frankfurt), primary European region, broad service availabilityeu-west-1(Ireland), secondary, commonly used for transatlantic latencyeu-west-3(Paris), French data residency requirementseu-north-1(Stockholm), Nordic clients
Time-zone coverage
CET (UTC+1) and CEST (UTC+2) are the primary European time zones. Managed DevOps cover options are business hours, extended or 24/7 depending on the plan, confirmed in the written scope.
Billing
Billing currency and VAT treatment are confirmed in the written scope and agreement. Rules on the reverse-charge mechanism for EU business clients with a valid VAT ID differ by country.
What working hours and overlap should European teams expect?
European teams can expect sessions scheduled in their own business hours, with the window written into the scope. Most of continental Europe uses CET (UTC+1) in winter and CEST (UTC+2) in summer, while Ireland and Portugal follow UK time and Finland and Greece are an hour ahead of Central Europe.
Remote delivery means the practical question is the shared window, not the office location. Central European mornings overlap with UK mornings, and afternoons overlap with the US East Coast, which suits companies that serve customers on both sides of the Atlantic.
Europe and the US change clocks on different dates in spring and autumn, so for a few weeks the gap shifts by an hour. We note those weeks when planning migrations, releases and cutovers.
Which cloud regions can European clients choose?
European clients can choose from a wide set of regions. On AWS they include eu-central-1 (Frankfurt), eu-west-1 (Ireland), eu-west-3 (Paris), eu-north-1 (Stockholm), eu-south-1 (Milan), eu-south-2 (Spain) and eu-central-2 (Zurich). On Azure they include Germany West Central, France Central, Sweden Central, North Europe (Ireland) and West Europe (Netherlands).
One practical detail: Frankfurt, Ireland, Paris and Stockholm are enabled by default in a new AWS account, whereas Milan, Spain and Zurich must be enabled before use. That also affects region-restriction policies, so we test them.
AWS has also launched a separate European Sovereign Cloud, announced as generally available in Germany in January 2026. It is intended for clients with stricter sovereignty requirements, and it is a distinct environment, so check the current service list and your own requirements before planning around it.
| Need | Regions often considered |
|---|---|
| German data residency | AWS eu-central-1 (Frankfurt), Azure Germany West Central |
| French data residency | AWS eu-west-3 (Paris), Azure France Central |
| Nordic customers | AWS eu-north-1 (Stockholm), Azure Sweden Central |
| Ireland or transatlantic traffic | AWS eu-west-1, Azure North Europe |
| Swiss or Italian data | AWS eu-central-2 (Zurich), eu-south-1 (Milan) |
What is the European data protection and security landscape?
The GDPR applies across the EU and EEA and sets the baseline for personal data, including principles such as data minimisation and integrity and confidentiality in Article 5, and security of processing in Article 32. It does not demand that all data stay in one country, but it does regulate transfers outside the EEA, which is why many clients keep data in EU regions.
Sector rules sit on top. DORA, Regulation (EU) 2022/2554, has applied to financial entities since 17 January 2025 and reaches their ICT providers through contracts. NIS2, Directive (EU) 2022/2555, is implemented by each member state, so national details differ. Both raise expectations around risk management, incident handling and supplier oversight.
We implement the technical side: encryption, access logging, network segmentation, backup and recovery, and evidence that controls work. Interpreting the law for your organisation remains a job for your legal counsel and compliance officer.
- Customer-managed encryption keys and TLS 1.2 or later in transit
- Region restriction through Service Control Policies or Azure Policy
- Audit logging with retention matched to your schedule
- Documented incident and recovery procedures
What do European procurement and contracting usually involve?
When a supplier processes personal data on your behalf, GDPR Article 28 expects a written contract, so a data processing agreement is a normal part of onboarding. Financial entities under DORA have additional contractual expectations for ICT services.
Procurement practices vary by country and by sector. Some organisations want contracts under local law, a security questionnaire or a review of subcontractors. Raise requirements early, because they decide start dates more than engineering does.
Invoicing, VAT treatment for cross-border business customers and currency are agreed in the contract, and the rules differ by country. Please confirm the details with us at scoping.
How does an engagement run?
We agree a fixed scope in writing, with a named senior engineer responsible for delivery. The work happens in your cloud accounts and repositories, through pull requests your team reviews.
At the end you receive working infrastructure, documentation and a walkthrough, with nothing critical held in systems only we control.
Frequently asked questions
Do we have to keep data in the EU?
Does DORA apply to us?
Which European regions can you work in?
Are the AWS European Sovereign Cloud and standard EU regions the same?
Can you advise on legal compliance?
European DevOps consulting
Book a working session to discuss your infrastructure and the technical side of your EU GDPR and DORA requirements.