Your data sits in Europe. But is it really under your control?

Data sovereignty has never been simple, but AI has raised the stakes. Keeping your data in Europe is not the same as keeping it under your control, and a single AI feature calling a model you don't own can undo an otherwise sovereign setup.

As the EU begins to measure sovereignty and write it into procurement, control is shifting from a preference to a requirement, especially across the public sector and regulated industries.

At TOPdesk, we believe you should be able to choose the level of control you need. Our Virtual Appliance lets you run the product entirely on your own infrastructure, and we are committed to it for the long term, including bringing AI capabilities to it in a way that maintains sovereignty.

Data residency is not data sovereignty

Residency and sovereignty are often used interchangeably but the terms speak to different, albeit connected, concepts. Residency is about where your data physically sits. Sovereignty is about who controls it and which laws can compel access to it. Your data can be stored inside the EU and still answer to a company bound by rules written on another continent.

At its core, sovereignty is about jurisdiction. Every piece of data sits under some legal framework, so the real question is whose. The greater the sovereignty, the more fully your data is governed by your own legal framework and protected from foreign jurisdiction. For a European organization, that means drawing a firm legal perimeter around your data, so your EU compliance standards hold and cannot be quietly overridden by regulation from another country.

Not every organization needs the same level of control

How much sovereignty you need depends on what you are holding. The more sensitive the data, and the more it would matter if a foreign authority could compel access to it, the more control you need over where it lives and who can reach it. For some organizations that is a deliberate choice. For others, it is a legal obligation they must be able to prove.

Sovereignty is daily reality for national and local government, much of the public sector, and regulated industries like finance and healthcare. Some are required to keep data and systems in-country or in-region. Others must run with no outside connection at all. For these organizations, sovereignty is not a preference but a bar they have to clear, which raises the obvious question: how do you measure it?

Sovereignty now has a scorecard

Sovereignty is established across several distinct domains, each of which can sit more or less under your control. To simplify tenders and ensure an appropriate level of control for a cloud service, the European Commission published its Cloud Sovereignty Framework in October 2025.

For public-sector and regulated buyers, this is fast becoming the language sovereignty requirements are written in, and it reaches software you run yourself, not only services you buy.

The scale is called the Sovereignty Effectiveness Assurance Level, or SEAL, and it runs from 0 to 4. The higher you go, the more control sits in European hands. Here is what each level means in plain terms:

The framework scores eight separate sovereignty objectives (called SOV for short) to determine the SEAL level. These objectives range from which laws can reach the provider, to who operates the service, to how data and AI models are governed, to where the hardware and software come from.

Each sovereignty objective gets its own SEAL level. The critical point is that your overall level is only as high as your weakest objective. Score SEAL-3 on seven of them and SEAL-1 on the eighth, and the whole service is SEAL-1.

In tenders, buyers can also set minimum SEAL requirements for each objective. Bids that fail to meet even one minimum can be disqualified, while those that qualify are ranked using a weighted sovereignty score.

One AI feature can change the whole scorecard

AI is one of the harder parts of sovereignty to get right because the AI features that most tools ship today reach out to a model hosted elsewhere, and the moment they do, your SEAL score can be impacted.

To leverage AI in a workflow, some of the data held in the ITSM system is sent to a Large Language Model (LLM) to be read and processed. That does not mean the model is learning from your data. A well-governed feature uses it to answer the request and nothing more. However, while that data is being processed, it sits on someone's infrastructure, under someone's law. That is exactly what the framework interrogates: whether the models behind a feature are built, hosted, and governed in Europe, and if their use can be audited.

When an AI feature calls a model that falls outside European law, the data-and-AI score (SOV-3) can drop. And because the weakest objective sets the ceiling, the whole setup is rated no higher than that one feature allows, however strong everything else is.

TOPdesk’s Virtual Appliance: designed for data sovereignty

As a company built and run in Europe, we have long understood the need some organizations have for data sovereignty. That is why we introduced our Virtual Appliance in 2018.

It provides TOPdesk’s core capabilities but runs on infrastructure you own: your data center, your private cloud, or a fully air-gapped environment with no path to the outside world. You decide where the data lives and who gets near it. New releases ship quarterly, and you apply updates on your own schedule. You also set the integrations and network boundaries.

By our own assessment, a customer-run Virtual Appliance can reach SEAL-3 on the sovereignty objectives tied to the software and its operation since hosting and operational control are in your hands. Your overall sovereignty level still depends on the rest of your environment, because a system is only as sovereign as the infrastructure and dependencies supporting it.

Our performance against the eight objectives falls into three groups: what TOPdesk establishes, what the Virtual Appliance enables, and what depends on your infrastructure:

TOPdesk establishes the foundation:

• SOV-1 Strategic: TOPdesk is a European company, headquartered and operated in the EU, with no controlling owner outside it.
• SOV-2 Legal and Jurisdictional: Because you run the Virtual Appliance yourself, TOPdesk does not host or operate your data. As a result, there is no channel through us for a foreign authority to compel access to it. As a European company, we are also governed by EU law.

The Virtual Appliance puts you in control of:

• SOV-3 Data: You hold the encryption keys, your storage and access logs stay in your environment. (AI is the open piece; see the next section.)
• SOV-4 Operational: Your team runs, supports, and updates it on your own schedule, with no outside operator in the loop. TOPdesk connects only if invited.
• SOV-6 Technology: Open, documented APIs help reduce dependency and vendor lock-in.
• SOV-7 Security and Compliance: Your own logging, monitoring, and patching cadence apply, backed by TOPdesk’s secure development and testing practices.

Your infrastructure determines:

• SOV-5 Supply Chain: The origin of the hardware, firmware, and some underlying software you run the appliance on.
• SOV-8 Sustainability: The energy use and hardware lifecycle follow your own data-center choices.

Adding AI without giving up control

The Virtual Appliance does not have AI yet, and that is a decision, not a delay. We are actively working through how to bring AI to the Virtual Appliance without lessening the very control the Virtual Appliance exists to protect.

"Our customers should not have to trade control of their data to gain the benefits AI can bring to ITSM. TOPdesk is committed to building a solution that delivers both."

- Yann Cluchey, Chief Technology Officer, TOPdesk

We have already brought AI capabilities to our SaaS product in a thoughtful and governed way, running on EU-hosted models that we operate under EU law. Your data is never used to train those models, every action is logged, and the feature can be switched off.

We intend to take the same considered approach here. There are three routes we see to securely add AI to the Virtual Appliance:

• TOPdesk hosts the model: Your Virtual Appliance connects to TOPdesk AI, running on EU-hosted models. Your data stays in the EU, though it does leave your environment to reach the model.
• You bring your own model: You connect the Virtual Appliance to a model you already run or contract for, with the level of sovereignty depending on where and how that model is hosted and governed.
• You run a model in your own environment: a model sits alongside the Virtual Appliance, so no ticket text leaves at all. This is the route for air-gapped sites.

Each route has tradeoffs we are weighing now, from how much control stays in your environment to how much operational work sits with your team.

What's next

We are committed to bringing our AI innovation to the Virtual Appliance and expect to settle on one or more options by Q1 2027. We will share the decision once made.

Already running the Virtual Appliance but have questions?

Your account manager can walk you through any of this.

Weighing whether the Virtual Appliance fits your requirements?

Get in touch and we will talk through your options.