Pulumi panelists disagree on how big the cloud sovereignty risk is, as one says stable workloads should stay put

Four functions asked, and each will accept a different kind of answer. Legal, asking what NIS2 means for where systems run, wants a mapping it can file ^[3]. Finance wants to know why the bill went up again ^[5]. The customer's security review wants a country name, in writing ^[6]. The leadership question, prompted by a report that the US government locked the cloud accounts of judges at the International Criminal Court, wants a scenario answer ^[4].

Pulumi's host listed ten questions before handing them to the panel ^[7]. Four ask whether a legal order can reach the data: whether a US court or agency can get it from the provider without involving the customer, whether putting everything in an EU region changes that, whether the big providers' "sovereign cloud" offerings are different or a rename, and whether encrypting everything and holding the keys yourself covers you ^[8]. Five ask what leaving would cost or take, including whether Hetzner, OVH and Scaleway are usable for real workloads, how much cheaper they are once migration is counted, and whether Pulumi and agentic infrastructure change what used to be a multi-year project ^[9]. The tenth asks whether the account could be switched off one day, and what to do then ^[23]. The published text answers the cost group and breaks off mid-sentence in the third panelist's section, without reaching the four questions about legal reach ^[10].

Waldemar Kindler co-founded Think Ahead Technologies, where he assesses EU companies' exposure to the big clouds and builds tools for moving off them ^[11]. The calls used to come mostly from critical infrastructure like energy, utilities and telecoms; now, he says, they increasingly come from ordinary mid-sized German companies that want more options, usually because the costs have gotten too high ^[12]. His advice in the post is to go try another cloud ^[13].

Sarbjeet Johal, a cloud economist and the panel's only US resident, did cloud assessments at VMware, then Rackspace, and has sold and sized cloud for about fifteen years since ^[14]. He came at it through vendor counts: most companies are trying to have fewer vendors so they can manage spend and negotiate better, and best of breed is the opposite of that ^[16]. Best of breed, Johal said, "works only if everything is portable, which is a very big assumption to make, which is hard to achieve" ^[15]. For systems that already run, his rule is to keep them where they are and change only on a rewrite or an acquisition ^[17].

Pulumi's introduction says one of the three moved his company off AWS and onto a European provider ^[20]. The section under Jim Dowling, co-founder and CEO of the Stockholm AI lakehouse company Hopsworks ^[19], is headed "Build for portability, or be a digital colony" before the text stops ^[21].

One way to split the ten questions is by who accepts the answer: legal accepts a document, finance accepts a unit cost, the customer's questionnaire accepts a country name, and the account-shutoff question accepts a written procedure. Three of those four can be produced without moving a byte. Of the two panelists whose answers Pulumi published, only Kindler's advice requires touching a running system ^[13]; Johal's requires an event, a rewrite or an acquisition ^[17].