Sovereign Kubernetes for NIS2 and DORA.
What the regulations require of your cloud infrastructure, and how a sovereign European Kubernetes platform satisfies them by construction.
NIS2 and DORA require operators of essential and financial entities to manage ICT third-party risk, keep data inside a legally defensible jurisdiction, and avoid dependencies that a foreign government can compel. A sovereign European Kubernetes platform operated by a German GmbH under German and EU law, with no US parent and no US subprocessors, satisfies these requirements structurally rather than contractually. enum Kubernetes Engine is such a platform: upstream Kubernetes with an HA control plane, run in Frankfurt, with no US CLOUD Act exposure.
What NIS2 and DORA require of cloud infrastructure
Both regulations put the infrastructure layer at the centre of compliance, not at the edge.
ICT third-party risk (DORA)
DORA makes financial entities responsible for the ICT services they depend on. A Kubernetes platform must be operable under a contract that lets the entity meet DORA's audit, incident-reporting, and exit-planning obligations, and the provider must not introduce jurisdictional risk the entity cannot control.
Supply-chain security (NIS2)
NIS2 holds operators of essential services accountable for the security of their supply chain, including cloud providers. The provider's corporate jurisdiction and data location become part of the operator's risk surface, not a detail outsourced to procurement.
Data location and lawful access
Both frameworks expect data to sit in a jurisdiction whose lawful-access regime is compatible with EU law. A provider subject to the US CLOUD Act or FISA Section 702 can be compelled to hand over data stored in the EU, which is hard to reconcile with a defensible NIS2 or DORA posture.
Resilience and incident response
NIS2 and DORA both require resilience and fast incident response. The underlying platform must offer high availability, clear escalation paths, and an infrastructure operator you can reach under EU law.
How a sovereign EU Kubernetes platform satisfies them
enum maps each requirement to a structural property of the platform.
Jurisdiction by construction
enum is a German GmbH (HRB 121362, Cologne) operating in Frankfurt under German and EU law only, with no US parent and no US subprocessors. The jurisdiction is the company, not a region selection.
No CLOUD Act, no FISA 702
Because enum has no US entity, it is not subject to the US CLOUD Act or FISA Section 702. Foreign authorities cannot compel access to data held by enum through US legal mechanisms.
EU-only data flows
All infrastructure runs in a Tier III+ data center in Frankfurt. No transatlantic data flows, no Schrems II exposure, no reliance on adequacy decisions or Standard Contractual Clauses that can be invalidated.
HA control plane included
Every cluster gets an isolated, highly available control plane across independent failure domains, with automatic failover and zero-downtime upgrades, at no per-cluster-hour charge. Resilience is built in, not a paid tier.
Own network, EU peering
enum operates its own Autonomous System (AS215998, RIPE NCC) with own IP ranges and direct peering at European Internet Exchanges. Network control sits inside the EU and is publicly verifiable on PeeringDB.
Upstream Kubernetes, no fork
Standard upstream Kubernetes with no fork means portable workloads, no lock-in, and an exit path that DORA's resolution-and-exit-planning requirements expect. Manifests, Helm charts, and GitOps pipelines move with you.
Sovereignty is structural, not contractual
The difference between a promise and a guarantee is where the company and the data sit.
German GmbH, German contracts
enum is operated by enum GmbH under German and EU law. Contracts, governance, and lawful-access regime all sit inside the EU.
Frankfurt data center
Data resides in a Tier III+ facility in Frankfurt, Germany. The physical location, the corporate jurisdiction, and the network are all EU-only.
CNCF Silver Member
enum is a CNCF Silver Member and a Linux Foundation member, anchored in the open-source standards that make Kubernetes portable and auditable.
Selecting an EU region at a US-headquartered provider does not change the jurisdiction of the company holding the data. The US CLOUD Act and FISA Section 702 apply to the corporate entity, not the region. For a workload governed by NIS2 or DORA, the defensible posture is a provider whose entire corporate structure sits inside the EU. enum is such a provider: a German GmbH, in Frankfurt, with no US entity and no US subprocessors.
Frequently asked questions
Does NIS2 require cloud providers to be EU-based?
Is enum Kubernetes Engine DORA-compliant?
What is the difference between an EU region and a EU provider?
How does enum help with DORA exit planning?
Does enum hold ISO 27001 or BSI C5 certification?
Can regulated workloads run on enum today?
Further reading
Start building on enum.
Self-service cloud infrastructure with a developer experience that gets out of your way. Built and operated in Europe.