SAP pitches on-site sovereign cloud, arguing local storage is not enough

An Australian data centre address is not the same thing as Australian control. That is the argument behind SAP’s pitch for sovereign cloud infrastructure hosted inside customers’ own facilities, including environments it says can operate completely disconnected from outside networks.

In SAP-sponsored material published by GovTech Review on 12 November 2026, the company describes SAP Sovereign Cloud On-Site as managed infrastructure built on open-source technology, deployed at a customer’s premises. The article does not specify an Australian launch date for that model.

Oliver Beck, SAP Sovereign Cloud’s CTO and head of technology and delivery, says the model can extend beyond delivering hardware to placing SAP staff alongside customers on-site.

“You could say that Sovereign Cloud On-Site is the ultimate version because it can be operated in a full air-gap mode. In that case, the environment would have no connectivity outside a given network,” Beck says in the sponsored article.

The pitch targets a harder question than where the servers sit: who actually controls them?

SAP divides sovereignty into four connected areas: data, operations, technology and law. Its argument is that local storage alone cannot resolve risks from offshore administrators, overseas telemetry flows, external software controls or foreign legal demands.

For Australian operations, Beck says SAP Sovereign Cloud employs Australian nationals in its facilities, with security clearances appropriate to the government customers they serve. He also says Australian teams pull software updates and control their deployment, rather than allowing overseas staff to access the environment.

Those are vendor claims, not independent findings. The supplied material does not establish that local staffing and disconnected infrastructure, by themselves, eliminate exposure to foreign legal demands. Beck’s broader assertions about legal protection should be read in that light.

The Australian sovereign cloud business predates this on-site pitch. In a primary-source announcement dated 25 July 2023, SAP announced general availability of sovereign cloud capabilities for Australia and New Zealand, delivered within Australia’s borders. It also announced investment in up to 70 specialist roles, not evidence that all those positions were subsequently filled.

That release said the service could store and process PROTECTED-level workloads and would not transfer business-critical or personal data outside Australia without explicit customer consent.

Separately, iTnews reported on 25 July 2023 that Toll Group was among the first enterprise users, citing its government and defence clientele and existing SAP environment. That secondary report establishes an early adoption account, not independently measured security outcomes.

For buyers, the distinction matters. The 2023 announcement and the later on-site description should not be treated as identical service specifications. SAP’s own framing also acknowledges that not every workload needs the strongest sovereignty controls. The task is matching the operating model to the sensitivity of the data, rather than treating an Australian postcode as the whole answer.