The new program introduces a competency for cloud service providers, combining Veeam’s data protection technology with local expertise in operations, governance, and jurisdictional requirements. 

[For more news, click here]

Veeam Software has launched a global program to help businesses identify cloud service providers equipped to address their data sovereignty requirements. The Veeam Sovereign Service Providers Program begins with a new Data Sovereignty Competency under the company's Cloud & Service Provider (VCSP) program, setting criteria that providers must meet to qualify. 

The first phase focuses on helping customers assess providers across data location, operational control, access governance, and legal jurisdiction. Veeam plans to introduce further offerings later this year as it works with product teams and selected service providers. 

To qualify, providers must demonstrate capabilities in areas including local operating models, jurisdictional controls, in-region personnel, data governance processes, customer oversight, and resilient data protection. Approved providers will be listed through Veeam partner profiles showing their sovereignty capabilities, regional coverage, and competency status. 

Veeam will provide the data protection technology, while participating providers will contribute local operating expertise and knowledge of the rules governing their services. The new competency will sit alongside existing VCSP offerings, including disaster recovery as a service and off-site backup, giving customers another factor to consider when choosing a provider. 

“Sovereignty is defined by each customer’s regional government, legal, regulatory and operational requirements. Meeting those requirements depends on both technology and the way a service is operated,” said Michelle Graff, Senior Vice President, Global Partnerships at Veeam. “The Veeam Sovereign Service Providers Program brings those two dimensions together. Veeam provides the technical foundation for resilient data protection, while trusted local partners contribute sovereign operating models, governance expertise, and established in-market capabilities. The VCSP Data Sovereignty Competency gives customers a clearer way to identify providers that have invested in both.”  

Veeam says qualification does not replace a customer's own legal, regulatory, risk, or compliance assessment. Businesses will still need to check whether a provider's arrangements meet the requirements that apply to their data and operations. 

AI and Regulation Bring Data Control Into Focus 

Governments and regulators are introducing or developing rules covering data residency, access, control, portability, and jurisdiction. Geopolitical uncertainty and reliance on services that cross national borders have added to businesses' concerns about who can access sensitive information and which laws apply. 

AI is adding to those concerns as employees and automated workflows use corporate data in ways that IT teams may not fully oversee. Veeam cited its own research, which found that 70% of organizations reported AI workflows interacting with sensitive corporate data without full oversight, while 67% said employees were creating autonomous AI workflows that IT teams could not fully track.  

“Across Europe, sovereignty has evolved from a compliance consideration into a strategic business requirement,” said Tim Pfaelzer, General Manager and Senior Vice President, EMEA at Veeam. “As regulation expands and organizations scale AI initiatives, they need greater certainty over where data resides, who can access it and which laws govern its use. Veeam’s technology, combined with the local operating capabilities of trusted service providers, gives customers a practical and defensible route to strengthen data control without sacrificing resilience or recovery.”  

For service providers, the new competency offers a way to demonstrate their capabilities to customers weighing their options. A local data center may address residency requirements, but customers may also need to examine who administers the service, how access is managed, and where operational responsibilities sit. 

“Sovereignty isn’t a checkbox. It is proof of jurisdiction, residency and control, verified end to end,” said Ahsan Khan, Chief Technology Officer, ThinkOn. “This recognition reflects the standard we set in Canada’s most regulated environments, and it is the same discipline guiding how we build for regulated customers across every market we serve.” 

The competency is the first phase of Veeam's wider program, with further offerings expected later this year. Its immediate purpose is to help customers identify providers that meet Veeam's criteria, while leaving businesses responsible for deciding whether a provider meets their specific legal, regulatory, and operational requirements. 

Related Articles 

AI Is Turning Data Sovereignty Into an Enterprise Infrastructure Problem 

MEEZA and Microsoft Launch Sovereign Private Cloud Offering in Qatar 

Exclusive: Romain Bottier on Data, Sovereignty and the Future of AI Infrastructure