Handbook · Section 6 of 8

Infrastructure

UK-operated cloud with customer-held keys, data centres under UK jurisdiction, and workloads portable between providers.

Version: 0.1.0
Status: Draft
Maintainers: The Sovereign Stack
Evidence layers: Cloud & hosting, Data centre location
Findings index: 44/100 from 55 findings

1. Specification

The evidence separates residency from control: data is stored in the UK, but the operator, the keys and the ability to suspend the service sit overseas (key finding 2). The sovereign approach moves from UK-hosted to UK-operated: operators the buyer chooses, keys the buyer holds, and workloads that can move between at least two providers.

2. Layer profile

Id	Criterion	Standard
IN-1	Data is stored and processed in the UK, and the operator with administrative access is in the UK.	General criteria G3 and G4; contract naming the operating entity and its staff location
IN-2	Encryption keys are held in a key service under the buyer’s control.	Buyer-controlled HSM or key management service; the provider cannot decrypt
IN-3	Object storage, compute and networking are reachable through open or de-facto open APIs.	S3-compatible object storage API; OpenStack or equivalent APIs
IN-4	The whole estate is described as code and can be re-created on another provider.	Infrastructure as code; tested rebuild
IN-5	At least two providers can run the workload, one of them UK-owned.	General criterion G9
IN-6	Suspension, degradation and repricing from outside the contract are excluded.	Contract terms; continuity plan tested

Already adopted in UK government

No Open Standards Board profile covers cloud or hosting (Open standards for government). Adoption is de facto: the Findings show the hyperscalers as the default, and Crown Hosting as the UK-owned alternative. The S3 object storage API is a de facto standard every provider implements, which is why IN-3 names it.

3. Open-source solutions that meet the profile

Not yet assessed. Candidates: OpenStack distributions, Kubernetes on bare metal, Ceph.

4. Public services implementing the standard

Not yet recorded. Candidate: Crown Hosting Data Centres, which the evidence records as UK-owned and operated.

5. Skills and horizon

Horizon 1: move from UK-hosted to UK-operated with customer-held keys. Horizon 2: multiple UK operators on standard frameworks. See the roadmap.

What this section rests on 55 findings

Every published finding in the Body of Knowledge for the layers this section covers. The Handbook recommends; the Findings show where we are. Open any row in the Stack Playground to see its sources.

Published findings for the layers covered by Infrastructure
Finding	Organisation	Product	Vendor	Owner country	Index
BBC-011	BBC	Amazon Web Services - BBC Online (WebCore: News, Sport etc.), iPlayer Video Factory, Sounds	Amazon Web Services	United States	30 · Dependent
BBC-012	BBC	Enterprise IT and hosting services (service desk, hosting, applications mgmt, networking, cloud mgmt, security & identity)	Atos IT Services UK (Eviden/Atos group)	France	58 · Partly sovereign
BBC-013	BBC	RISE with SAP on AWS (finance, HR, procurement)	SAP; Amazon Web Services	Germany	37 · Dependent
BBC-014	BBC	Microsoft Azure (Cognitive Services/Bot Service for 'Beeb' voice assistant; Copilot)	Microsoft	United States	28 · Dependent
BBC-016	BBC	BBC/Atos/Vodafone on-prem data centres and broadcast technical accommodation (London, Salford, Cardiff, Glasgow etc.)	Atos; Vodafone; BBC in-house	United Kingdom	85 · Sovereign
DEF-018	Defence	Microsoft Azure private cloud (UK-hosted Azure) – consulting, support and maintenance	Microsoft	United States	25 · Dependent
DEF-019	Defence	Amazon Web Services within MODCloud (hosts the Defence Data Analytics Platform)	Amazon Web Services	United States	17 · Exposed
DEF-020	Defence	Oracle Cloud Infrastructure (MODCLOUD business applications; new OCI agreement Jan 2026 for legacy modernisation)	Oracle	United States	17 · Exposed
DEF-021	Defence	UKCloud connected/assured cloud services (provider liquidated Oct 2022)	UKCloud	United Kingdom	63 · Partly sovereign
DEF-022	Defence	Migration of a mission-critical SECRET C4IS command-and-control system to hybrid cloud	Not named (tender)	Unknown	45 · Dependent
DEF-023	Defence	Ark Spring Park data centre, Corsham (consolidated MoD hosting after closure of Bath site)	Ark Data Centres	United States	65 · Partly sovereign
DEF-024	Defence	Microsoft UK data centre regions hosting MoD Office 365 / Azure workloads	Microsoft	United States	25 · Dependent
DEV-009	Devolved Governments	Data residency of Cloud Platform Service (AWS and Azure): no contractual UK-only hosting	Amazon Web Services; Microsoft	United States	30 · Dependent
DEV-016	Devolved Governments	AWS hosting for devolved benefits digital systems	Amazon Web Services	United States	27 · Dependent
DEV-020	Devolved Governments	Microsoft Azure hosting renewal for national digital health systems	Microsoft (via Computacenter)	United States	27 · Dependent
DEV-021	Devolved Governments	National Digital Platform hosted on AWS	Amazon Web Services	United States	27 · Dependent
DEV-030	Devolved Governments	Microsoft Azure via Softcat Licensing Solutions Partner (cloud since 2013)	Microsoft (via Softcat)	United States	25 · Dependent
DEV-045	Devolved Governments	DHCW cloud transition to Azure and Google Cloud (~90 national services, 1,600 servers)	Microsoft; Google (partners TPX Impact, KPMG, Trustmarque)	United States	25 · Dependent
DEV-046	Devolved Governments	DHCW on-prem data centre DC1 (Tier III) being emptied to cloud; CDW migration contract	CDW	United States	52 · Partly sovereign
DEV-050	Devolved Governments	Fully hosted and managed Epic platform in two active-active data centres, plus L2 service desk	Telefonica Tech	Spain	35 · Dependent
DEV-058	Devolved Governments	IT Assist cloud, infrastructure and support services (on-prem estate moving toward public cloud)	Hewlett-Packard Ireland	United States	35 · Dependent
GOV-010	Central Government	AWS via One Government Value Agreement (OGVA 2.0, 3-yr MoU)	Amazon Web Services	United States	30 · Dependent
GOV-011	Central Government	AWS hosting (G-Cloud call-off under OGVA 2.0)	Amazon Web Services	United States	27 · Dependent
GOV-012	Central Government	AWS hosting to exit Fujitsu legacy data centres	Amazon Web Services	United States	27 · Dependent
GOV-013	Central Government	AWS cloud hosting (earlier OGVA call-off)	Amazon Web Services	United States	35 · Dependent
GOV-014	Central Government	AWS public cloud hosting	Amazon Web Services	United States	35 · Dependent
GOV-015	Central Government	Microsoft Azure (via Softcat, TPAS2)	Microsoft	United States	35 · Dependent
GOV-016	Central Government	Microsoft Azure under SPA24 MoU	Microsoft	United States	27 · Dependent
GOV-017	Defence	Google Distributed Cloud air-gapped sovereign cloud	Google Cloud	United States	51 · Partly sovereign
GOV-018	Central Government	Google Cloud strategic partnership (legacy tech exit, 100k civil servant skills)	Google	United States	36 · Dependent
GOV-019	Central Government	Oracle Cloud (SaaS/IaaS/PaaS licence uplift)	Oracle	United States	11 · Exposed
GOV-020	Central Government	Crown Hosting Data Centres (Crown Hosting II)	Crown Hosting Data Centres Ltd (Cabinet Office 25% / Ark Data Centres)	United States	87 · Sovereign
GOV-021	Central Government	GOV.UK PaaS (Cloud Foundry on AWS) - retired	GDS (in-house) on AWS	United Kingdom	90 · Sovereign
GOV-023	Central Government	Crown Hosting / Ark campuses (UK)	Ark Data Centres	United States	86 · Sovereign
GOV-024	Central Government	Fujitsu-run legacy data centres (being exited by June 2028)	Fujitsu	Japan	56 · Partly sovereign
HE-012	Higher Education	Microsoft Azure (Jisc cloud partnership, Azure academic egress waiver)	Microsoft	United States	49 · Dependent
HE-013	Higher Education	Amazon Web Services (Jisc Managed AWS / partnership; hosts Tribal SITS Cloud)	Amazon Web Services	United States	49 · Dependent
HE-014	Higher Education	OCRE cloud framework (GEANT) - Google Cloud, Oracle Cloud and others	Google; Oracle; various	United States	45 · Dependent
LG-005	Local Government	Microsoft Azure IaaS hosting council servers, with Azure Sentinel	Microsoft (via Insight Direct)	United States	30 · Dependent
LG-006	Local Government	Amazon Web Services (AWS) cloud hosting commitment	Amazon Web Services	United States	33 · Dependent
LG-007	Local Government	Microsoft Azure hosting bought alongside the Microsoft Enterprise Agreement	Microsoft (via Ultima)	United States	33 · Dependent
LG-008	Local Government	UKCloud – UK-owned sovereign cloud used by public sector (collapsed 2022)	UKCloud (liquidated)	United Kingdom	60 · Partly sovereign
LG-009	Local Government	Partnership-owned data centre hosting SAP ERP for councils, police and fire	Hampshire County Council (own data centre)	United Kingdom	79 · Sovereign
LG-010	Local Government	Legacy on-premise council server rooms exploited in ransomware attacks	Council-run (in-house)	United Kingdom	82 · Sovereign
LG-011	Local Government	Third-party data centre hosting after exit from Medway data centre	Unnamed external data centre vendor	Unknown	80 · Sovereign
NHS-006	NHS	AWS – national services (Spine 36 services, NHS login, e-RS, 111 DoS, MESH)	Amazon Web Services	United States	27 · Dependent
NHS-007	NHS	Microsoft Azure – NHSmail shared tenant, Copilot, NHSE analytics; ICB/trust Azure subscriptions	Microsoft	United States	32 · Dependent
NHS-008	NHS	Palantir Foundry SaaS hosting for Federated Data Platform	Palantir (on hyperscaler cloud)	United States	38 · Dependent
POL-011	Policing	AWS public cloud hosting (Home Office incl. Law Enforcement Cloud Platform / Police Open Systems)	Amazon Web Services	United States	30 · Dependent
POL-012	Policing	Microsoft Azure platform for National Enabling Programmes (with Deloitte as delivery partner)	Microsoft (Deloitte delivery)	United States	30 · Dependent
POL-013	Policing	Azure VMware Solution migration of force datacentre servers	ANS Group (Microsoft Azure)	United States	55 · Partly sovereign
POL-014	Policing	NAS hosting and associated managed PaaS services	Redcentric Solutions	United Kingdom	77 · Sovereign
POL-015	Policing	PNC mainframe datacentre in Hendon, north London	Fujitsu Services	Japan	58 · Partly sovereign
POL-016	Policing	Microsoft UK datacentres (M365/Azure) with overseas processing and remote access	Microsoft	United States	23 · Exposed
SCH-012	Schools	On-premises school server rooms	Schools (self)	United Kingdom	83 · Sovereign

Changelog

0.1.0 · 2026-10-19
Specification and layer profile seeded from the reference architecture. Solutions not yet assessed.

Change this section

The recommendations in this section are made by The Sovereign Stack Consortium, now forming.

Sections are Markdown in a public repository. Propose a change as a pull request, or open a discussion first. Contributions are reviewed by the section's maintainers under the Handbook governance. Text is licensed CC BY 4.0.

Edit this section Discuss this section