Sovereignty, Step by Step: What Companies Should Consider in Their Data Strategy

Digital sovereignty is a key issue across all industries. While many companies want to gain greater control over their data and become less dependent on individual platform providers, many still lack a clear strategy for doing so. Sönke Liebau, co-founder and CPO of Stackable, has been exploring for years how companies can operate their data infrastructure independently. In this interview, he explains why the biggest obstacles are rarely technical in nature, what role open source plays – and why a certain amount of courage is often lacking on the path to digital sovereignty.

Many companies want to become more independent, yet words are often not followed by action – for example, when they stick with a provider despite recognizing their dependencies. In your opinion, what are the biggest barriers on the path to digital sovereignty?

We generally observe two categories of barriers: openly stated arguments – and unspoken, corporate policy-related, or cultural reasons.

 Often, a shortage of skilled workers, costs, or technical complexity are cited as the biggest roadblocks. Many companies say, for example, “We don’t have the technical expertise” or “The migration would be too costly.” And yes, these points do play a role, but in most cases they can be resolved, for example through the use of managed services from external partners or through training and knowledge-building. We often get the impression that the real hurdles lie deeper. Whoever decides on a migration as an IT manager or CTO and it fails bears the consequences – not the external consultant, not the software provider. This asymmetry is real. On top of that, decision-makers rarely act alone: they need a budget, board approval, and internal backing. What’s often missing is a shared vision of what such a transition might look like – as a calculable project, not a leap into the unknown. Many companies still operate by the principle “Nobody ever got fired for buying …”. That may be justified in some cases, but it inevitably creates long-term dependencies. Sometimes, sovereignty simply requires more courage. We’re seeing this right now in France, for example, where all ministries are set to rely on open-source solutions in the future.

Do you have any advice for companies on how to overcome these hurdles, for example when there are fears about risks or responsibility?

To put it plainly: The technical and financial hurdles cannot, of course, simply be brushed aside or ignored. It is understandable that companies would rather not take risks. Such projects – whether software migrations or complete infrastructure changes – are demanding, but can be effectively managed through standardization, automation, and external support – companies do not necessarily need to have their own expert for every area. The deeper-rooted hurdles are harder to overcome. This is where leadership and a strategic perspective are needed. Digital sovereignty should not be viewed as a “nice-to-have”; after all, it’s about securing the future. You don’t even need a master plan to start – for the first step, it’s enough to begin with a clearly defined pilot project, such as a new standalone internal application running on a sovereign infrastructure. Once those in charge see that new approaches work and the risk decreases, the fear of change usually disappears quickly, and the internal discussion shifts. Digital sovereignty doesn’t have to be an overnight strategic decision – it can start as a concrete project that is pursued step by step.

Digital sovereignty is often used merely as a buzzword. What does the term mean to you as a data expert?

For us, it means above all that companies have – or regain – complete sovereignty over their data. It’s about having control over where the data is stored – but also the freedom to decide for themselves how it is used, with whom it is shared, and how it is further developed. Technically, this is best implemented using approaches based on open standards and portable components – so that companies can operate their infrastructure in the environment that suits them best: on-premises, in the cloud, or in a hybrid setup. What matters here is not the label, but the question: Who ultimately has control – the company or the provider? And does the freedom to switch providers remain if requirements change, or does this merely create a new form of vendor lock-in?

What role do external providers play in digital sovereignty?

We see ourselves as enablers. We provide the technological foundation that allows companies to become owners of their own data platforms without having to develop everything from scratch. In addition to the software, we also provide expertise for building and operating data platforms. The goal is to empower companies to manage their own data platforms and infrastructure – while we provide support, security updates, and new features. And we enable this autonomy through open-source components. That is the major advantage of open source: the source code is always accessible, and tools curated by the international open-source community are used. This creates true independence.

So is open source the key to digital sovereignty?

Open source is not a panacea, but it is a key tool for reducing dependencies. With proprietary, or closed, solutions, three factors are particularly critical: dependence on individual vendors, limited access to source code, and a lack of options for switching providers. This is exactly where open source comes in: open code with the appropriate open source license makes systems transparent and customizable, makes it easier to switch providers, and reduces lock-in effects. However, true autonomy only arises when companies can actually make use of this freedom. This requires in-house expertise, clear operating models, and defined responsibilities. Many organizations therefore combine open-source technologies with commercial services, such as for support or security. The key is that control over systems and data remains in-house – not with the vendor.

Is switching from proprietary software to open source complex, or does it automatically entail more responsibility?

Actually, quite the opposite: even proprietary software that I purchase and operate myself must be something I, as a company, can operate and master. With open source, this is even easier, precisely because I can read the source code if I don’t understand something. The key difference is rather that the level of vertical integration often needs to be higher with open source, since you can’t get everything “managed” or “as a service,” and many companies are no longer accustomed to operating systems themselves. But in the long run, the advantages outweigh the disadvantages: greater transparency, less dependence on individual providers, and significantly more flexibility in further developing one’s own infrastructure. Thanks to automation and standardized modules, complexity can be managed today. Our customers really appreciate that.

In a study by the consulting firm Adesso, the surveyed companies stated that they are even willing to pay more for sovereign solutions. Does digital sovereignty have to be expensive?

No, not at all. While costs may arise in the short term – for example, for migration or training – they decrease in the long run because proprietary licensing models are eliminated, and companies are no longer at the mercy of manufacturers’ pricing. Anyone who keeps an eye on the total cost of ownership, the TCO, will realize that sovereignty makes perfect economic sense. When it comes to data platforms, it also makes sense to choose a transparent provider. Are there any hidden costs related to data volume, the number of users, or general scalability? If you take these points into account, you’re on the safe side.

Can European countries learn from each other when it comes to open source and digital sovereignty?

That certainly wouldn’t hurt. Especially when it comes to embedding open source and digital sovereignty in the public sector as well. 

There are positive examples from Germany, such as Schleswig-Holstein’s open-source strategy to strengthen digital sovereignty. In the broader context, however, there is room for improvement – as evidenced by the over eight billion euros the federal government pays to U.S. companies for individual and framework contracts. Switzerland, for example, has introduced a law requiring government software to be released as open source. Other countries, such as Finland or the Scandinavian nations, are also leading the way with such initiatives. And then, of course, there is the aforementioned example in France. Of course, the path to data sovereignty requires courage, but that courage will pay off. The path to digital sovereignty is rarely straightforward – and those who take it usually do so not based on a single decision, but step by step. What I take away from many conversations is this: The first concrete step changes the perspective. Not because it solves all problems, but because it shows that digital sovereignty is not wishful thinking, but achievable.

Sönke Liebau is Co-Founder and CPO of Stackable. He focuses on questions of data sovereignty, open source, and the challenges companies face when seeking to regain greater control over their digital foundations. Stackable develops open-source data platforms and was selected by the European Commission to participate in the Cyber Resilience Act (CRA) Expert Group, which advises the Commission on implementation-related questions.

Stackable GmbH was founded in 2020 by Lars Francke and Sönke Liebau in Wedel (Schleswig-Holstein). The company develops a modular open-source data platform that bundles the most common data apps and can be flexibly expanded. Stackable currently employs around 20 people.