The Cloud Market Is Global. The Opportunity Is Regional.

Three hyperscalers now control more than two-thirds of the global cloud infrastructure market between them — AWS holds roughly 31%, Microsoft Azure 25%, and Google Cloud 11% [Holori]. By most conventional measures, that's efficiency. Massive scale, constant innovation, a platform for almost anything.

It's also exactly the problem regulators, boards, and increasingly your own customers have started asking hard questions about.

Three years of accelerating sovereign cloud market growth

The market size in numbers

The sovereign cloud market was valued at roughly $117.5 billion in 2025, is projected to reach $139.3 billion in 2026, and is on track for $651.4 billion by 2035 — a compound annual growth rate of 18.7% [Precedence Research]. Asia-Pacific is the fastest-growing region at 22.1% CAGR, and the European Commission alone has earmarked €1.3 billion for sovereign cloud infrastructure between 2025 and 2027 [Precedence Research].

Gartner's term for this shift: Geopatriation

Gartner has a name for what's driving this: “Geopatriation” — organizations deliberately pulling critical workloads back under regional or national control in response to geopolitical instability, rather than leaving them with providers headquartered somewhere else entirely [Virtualization Review]. The firm has gone as far as renaming its flagship cloud assessment from “Cloud Infrastructure and Platform Services” to “Strategic Cloud Platform Services” — a signal that trust and jurisdiction now matter as much as feature checklists [Virtualization Review].

The data backs it up: 60% of enterprises in regulated industries now say they'll prefer private cloud or data-center-based sovereign options over hyperscaler offerings [TechTarget].

The implications for a regional operator

For a hyperscaler with a presence on every continent, that's a diversification footnote. For a regional operator, it's close to the whole addressable market walking in the door at once — because those enterprises don't have a long list of sovereign providers to choose between in their own jurisdiction; they have however many exist today, plus whoever moves first. The $651.4 billion a market analyst is forecasting for 2035 isn't demand you have to go create. It's demand that's already been told, by its own regulators, to go find someone like you.

Sovereignty is not a compliance checkbox anymore — it's a market

If your data center serves customers in more than one jurisdiction, you've probably already felt this shift firsthand. In India, payment system data has been required to stay within the country since 2018 [RBI], the DPDP Act gives government the power to restrict cross-border transfers by notification [MediaNama], and government workloads specifically must run on sovereign, empanelled Indian clouds [Spice Route Legal]. Similar patterns are playing out across the EU, the Middle East, and Asia-Pacific, each with its own version of the same underlying demand: prove where the data lives, prove who can access it, and prove you can keep proving it.

Here's the opportunity most data center leaders miss in that requirement: it isn't only a cost of doing business. Every enterprise that can't meet a hyperscaler's jurisdiction on its terms is a customer looking for exactly what a regional operator is positioned to offer — infrastructure that's demonstrably local, accountable, and built on open standards instead of a single vendor's roadmap.

The requirements for building a real sovereign cloud

This is where most conversations about “sovereign cloud” stay too abstract to act on. In practice, it comes down to four hard requirements:

1. Jurisdictional control. Infrastructure and control planes that stay inside your jurisdiction — not just the data, but who can reach it and under what legal authority.
2. Hardware and hypervisor freedom. Your choice of stack, rather than being locked to one vendor's roadmap.
3. Provable isolation and compliance. An architecture that can demonstrate isolation and compliance on demand, not just claim it on paper.
4. Round-the-clock operational discipline. The part almost nobody budgets for: monitoring, patching, incident response, and SLA-backed uptime — permanently, not just at launch.

That last requirement is where sovereign cloud projects most often stall. Standing up the infrastructure is a finite project. Running it — with 24/7/365 monitoring, security patching, incident response, and SLA-backed uptime — is a permanent commitment. Get it wrong, and you're not the operator who wins the enterprise that just got told to bring its workloads home; you're the one they cite when a regulator asks why the “sovereign” provider they chose couldn't produce an uptime record or an audit trail on demand.

Key considerations before you commit

Before choosing how to build — or who to build with — a sovereign cloud strategy stands or falls on a short list of decisions:

• Data and control-plane residency. Can you prove not just where data sits, but who can access it and under what legal authority?
• Hardware and hypervisor independence.Are you free to choose your stack, or locked into one vendor's product cycle?
• Operational SLA capability.Do you have 24/7/365 monitoring, patching, and incident response in-house — or is that a gap you'd be building sovereignty on top of?
• Audit and compliance readiness. Can you produce isolation and compliance proof the moment a regulator or customer asks, not just describe it in a policy document?
• Monetization and go-to-market. Once the infrastructure is compliant, can you actually meter, bill, and resell it — or does that stay a manual, spreadsheet-driven process?

StackOrbit's approach to this shift

Getting the infrastructure right is the table-stakes half of this. StackOrbit's Apache CloudStack consulting engagement handles that end — assessment, deployment, and 24/7/365 SLA-backed support across your environment, backed by a team that's taken more than 100 deployments live globally, so you're not left running a sovereign cloud unsupported six months in.

But solving where your infrastructure lives was never the hard part of this shift — it's the part every regulator's checklist already tells you how to pass. The question no compliance framework answers is what that infrastructure makes you as a business. Most sovereign cloud builds treat monetization as an afterthought: the compute is compliant, the data never leaves the jurisdiction, and there's still no clean way to meter it, bill for it, or sell it to a reseller without a spreadsheet and a support ticket.

That's the layer StackBill is built to close. It's StackOrbit's cloud billing and business platform for Apache CloudStack — usage-based metering across compute, storage, and bandwidth, automated quote-to-cash billing, multi-tenant and reseller pricing, and self-service provisioning your customers can use without opening a ticket. It's the same open, Anything-as-a-Service model, purpose-built for sovereign cloud markets: the infrastructure you've made compliant becomes infrastructure that pays for itself and keeps growing, without you rebuilding a billing stack from scratch alongside the NOC you already had to stand up.

The next wave of cloud growth isn't going to hyperscalers with the biggest global footprint. It's going to the operators who can prove their infrastructure is local and controlled — and turn that proof into a business.

Frequently asked questions

Published by StackOrbit — follow us on LinkedIn for more on sovereign cloud, CloudStack, and cloud business enablement.