Dutch Municipal Cloud Sovereignty
The Municipal Cloud Map Is Mostly Blank
For 221 of 342 Dutch municipalities (65%), there is no public record of which cloud provider they use. This interactive map documents the publicly available evidence of cloud infrastructure choices across all gemeenten, revealing the scope of dependency on US hyperscalers and highlighting the few municipalities pursuing sovereign alternatives.
Key Findings
What the Data Reveals
Based on EU tender databases, official audits, trade press investigations, vendor case studies, and municipal vacancy postings reviewed through May 20, 2026.
65% Opaque (221 municipalities)
No public record exists of which cloud provider these municipalities use. The absence of documentation is itself a finding, not a gap in research. There is no central registry of Dutch municipal cloud contracts.
7 Confirmed via Tender or Audit
Amsterdam, Rotterdam, Alkmaar, Hoeksche Waard, Alphen aan den Rijn, and Kaag en Braassem (Microsoft Azure). Utrecht (multi-cloud via SoftwareOne, disclosed February 2026).
110 Azure-Assumed
Municipalities where hiring patterns, shared service agreements, or VNG GT Microsoft framework participation indicate Azure as the likely platform, but no tender disclosure exists.
4 Sovereign-Leaning
Eindhoven and Sittard-Geleen (Haven platform with SUSE Rancher). Hilversum and Maastricht (EU-managed infrastructure via Proximus NXT).
Zero AWS or Google Cloud
Across all 342 municipalities, zero public records name Amazon Web Services or Google Cloud as the primary cloud platform.
Why This Matters for Public Sector Organizations
Digital Sovereignty and Compliance
Dutch public sector organizations face increasing pressure to meet sovereignty requirements under HAVEN+, NIS2, and DORA regulations. Understanding the current landscape reveals both the scale of hyperscaler dependency and the emerging alternatives.
HAVEN+ Public Sector Requirements
Dutch government cloud framework requires data sovereignty. Data must remain under Dutch/EU jurisdiction. US hyperscalers (AWS, Azure, Google Cloud) subject to US CLOUD Act fail to meet sovereignty definition regardless of "EU region" server location.
Amsterdam's Digital Autonomy Plan (February 2026)
Gemeente Amsterdam announced a digital independence roadmap. First pilot with European workplace software in 2026. At least 30% of cloud workloads on European services by 2031. No sensitive residents' data on US cloud services by 2035. Wethouder Alexander Scholtes: 'De Microsoft-afhankelijkheid maakt ons kwetsbaar.'
VNG GT Microsoft Framework
321 of 342 municipalities participate in the VNG collective Microsoft agreement. Covers Microsoft 365 licensing (productivity software), not necessarily Azure public-cloud workloads. A follow-up mass agreement is under negotiation for after 2027.
Emerging Sovereign Alternatives
Eindhoven leads as the first gemeente with a Haven-compliant Kubernetes platform on SUSE Rancher Suite (delivered by Fundaments). Sittard-Geleen described as "koploper" in moving away from US tech giants through open-source software and Haven platform.
Methodology & Data Quality
Research Approach and Evidence Standards
This research uses only publicly documented evidence. No private information, no assumptions without basis. Each classification is supported by named sources with URLs.
Evidence Sources
EU tender databases (TED, TenderNed, Overheid.nl). Official gemeente audits and policy documents. Trade press reporting (Computable, iBestuur, Binnenlands Bestuur). Vendor case studies (with named gemeente officials). Municipal vacancy postings (Azure/M365 specialists).
Classification Tiers
Confirmed: Documented via tender, audit, or official disclosure. Assumed: Inferred from hiring patterns, shared service agreements, or vendor relationships. Opaque: No public record found through May 20, 2026.
Absence of Evidence as Data
For 221 municipalities, no public record exists. This is a finding, not a gap. There is no central registry of Dutch municipal cloud contracts. The lack of transparency is itself significant for sovereignty and accountability.
Corrections Welcome
This is living research. If you have public documentation that updates or corrects a classification, the interactive map includes a correction request form. All sources must be publicly verifiable.
Interactive Map Features
Explore the Full Dataset
The interactive map provides gemeente-by-gemeente detail with full source citations, bilingual interface (NL/EN), and downloadable JSON dataset.
Per-Gemeente Detail Panel
Click any municipality on the map to see its classification, evidence tier, detailed notes, and full source URLs. Sources include tender links, press coverage, and vendor case studies.
Search and Filter
Search by gemeente name. Filter by classification (Azure confirmed, Azure assumed, sovereign-leaning, multi-cloud, opaque). View statistics and breakdowns.
Bilingual Interface
Toggle between Dutch and English. All UI elements, classifications, and methodology text available in both languages.
Dataset Download
Export the complete dataset as JSON with all 342 municipalities, classifications, evidence tiers, notes, and source URLs. Licensed under Creative Commons CC BY 4.0.
The Sovereignty Challenge
Why "EU Regions" Aren't Sovereign
Physical server location in Europe does not provide sovereignty. Corporate ownership determines legal jurisdiction. US hyperscalers with "EU regions" remain subject to the US CLOUD Act.
Schrems II and the CLOUD Act
Court of Justice of the European Union (CJEU) invalidated EU-US Privacy Shield due to US surveillance laws including the CLOUD Act. Ruling applies to hyperscaler "EU regions" because they are operated by US-incorporated companies.
Azure Netherlands vs Leafcloud Amsterdam
Azure Netherlands: Servers in Amsterdam, but Microsoft is US-incorporated. Subject to US CLOUD Act and FISA. Leafcloud Amsterdam: Servers in Amsterdam, Dutch B.V. ownership. NOT subject to US CLOUD Act. True EU sovereignty.
Public Sector Implications
HAVEN+ requires true sovereignty, not just EU server location. NIS2 cybersecurity rules treat foreign government access as a supply chain vulnerability. DORA requires operational resilience that hyperscaler jurisdiction risk undermines.
Learn More About the CLOUD Act
For detailed analysis of US CLOUD Act implications and why hyperscaler EU regions don't provide sovereignty, see our dedicated resource page.
Explore the Dutch Municipal Cloud Map
Interactive map with full methodology, per-gemeente sources, and downloadable dataset. Discover which Dutch municipalities have documented their cloud infrastructure and which 221 remain opaque.
Need EU-Sovereign Cloud for Your Organization?
Leafcloud provides true EU-sovereign cloud infrastructure for Dutch public sector organizations. Dutch B.V. ownership, Amsterdam datacenter, HAVEN+ compatible, NIS2 ready. Contact our team to discuss your sovereignty requirements.