DevOps as a Service Stockholm Södermalm — multi-cloud

Data residency

No general legal requirement to store data in Sweden. Constraints come from GDPR Chapter V transfer rules, the Protective Security Act (säkerhetsskyddslagen 2018:585) for security-sensitive activities, and public-sector legal opinions (notably from eSam) that treat US CLOUD Act exposure as a barrier to placing confidential public-sector information with US-controlled providers.

What shapes cloud procurement here

Public-sector and public-adjacent buyers procure under the Public Procurement Act (LOU, SFS 2016:1145), which means formal tenders, published award criteria and limited scope for informal vendor relationships; the practical effect is long lead times and heavy documentation. The dominant technical debate is jurisdictional rather than geographic: all four major hyperscalers now operate in-country regions (AWS Stockholm, Azure Sweden Central/South, Google europe-north2, OCI eu-stockholm-1), so buyers rarely argue about latency and instead argue about whether a US-controlled provider can be used at all for confidential information given CLOUD Act exposure — a question Swedish government legal opinions have left unresolved. NIS2 obligations landed via the Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506, in force 15 January 2026), pushing incident-reporting and supply-chain security clauses into contracts across 18 sectors, while English is the normal working language of Swedish engineering teams even where contracts and public tender documents are in Swedish.

Sector regulators