Discuss a project
menu

Digital Sovereignty

keep control of your technology.

We help organizations reduce critical technology dependencies across cloud, software, data, AI and identity, then design and build architectures they can actually control.

We are engineers, not a management consultancy. We assess the problem, architect the solution, and build and operate the technology it needs.

Talk to an engineer Assess your dependencies
01

your stack works. but how much of it do you actually control?

Modern software depends on cloud platforms, SaaS vendors, identity providers, AI APIs, proprietary infrastructure and external software supply chains.

Those dependencies are not necessarily a problem. A managed service you could replace in a sprint is a reasonable trade. One that holds your signing keys, your user directory or the only copy of your data may not be.

Dependencies become a problem when they create unacceptable constraints. We help teams identify which ones actually matter, and engineer practical alternatives where they do.

Where constraints appear

  • Data ownership
  • Jurisdiction
  • Vendor lock-in
  • Portability
  • Security
  • Operational continuity
  • Identity
  • AI infrastructure
  • Software supply chains
SYSTEMyour organization
  1. Infrastructure
    • container workloads (Portable)
    • managed database (Critical dependency)
    • backups (Controlled)
  2. Data
    • primary datastore (Controlled)
    • analytics SaaS (Critical dependency)
    • encryption keys (Controlled)
  3. Identity
    • proprietary IdP (Critical dependency)
    • OIDC login (Portable)
    • credential issuance (Controlled)
  4. AI
    • hosted LLM API (Critical dependency)
    • embeddings (Portable)
    • local inference (Controlled)
  5. Software
    • open-source libraries (Controlled)
    • closed SDK (Critical dependency)
    • CI/CD (Portable)
  6. External vendors
    • email delivery (Portable)
    • payments (Portable)
    • support desk (Portable)
  • Controlled
  • Portable
  • Critical dependency
Illustrative dependency map. Every organization's looks different.
02

six areas of control

Digital sovereignty is not a separate discipline for us. It is where our work in identity, privacy, AI, security, infrastructure and open source meets one question: what happens to this system if a dependency changes its terms, its jurisdiction or its availability?

01 / INFRASTRUCTURE

Cloud & Infrastructure Sovereignty

Understand where infrastructure dependencies exist and how difficult they are to replace.

We help with

  • Cloud dependency analysis
  • Infrastructure portability
  • European and self-hosted infrastructure
  • Containerized, portable architectures
  • Exit strategies
  • Reducing hyperscaler lock-in
  • Disaster recovery and operational resilience
02 / DATA

Data & Privacy Sovereignty

Keep sensitive data under appropriate technical and organizational control.

We help with

  • Data flow analysis
  • Data residency architecture
  • Local-first processing
  • Privacy-preserving systems
  • Encryption and key ownership
  • Minimizing third-party data exposure
  • Data classification
  • Data protection impact assessments
  • Secure data architecture
03 / AI

AI Sovereignty

Use AI without automatically giving up control over sensitive data, models or infrastructure.

We help with

  • Local AI
  • Private enterprise AI
  • Self-hosted models
  • Inference architecture
  • RAG systems
  • AI provider abstraction
  • Model portability
  • AI data leakage analysis
  • Reducing dependency on a single AI provider
04 / IDENTITY

Identity Sovereignty

Build identity systems on open standards instead of proprietary identity silos.

We help with

  • EUDI Wallet
  • SSI
  • Verifiable credentials
  • OpenID4VC
  • OpenID4VCI
  • OpenID4VP
  • Decentralized identity
  • Credential infrastructure
  • Keycloak
  • Interoperable identity architecture
  • Identity provider portability
05 / SOFTWARE

Software & Supply Chain Sovereignty

Understand which parts of the software stack are strategic dependencies.

We help with

  • Open-source strategy
  • Software dependency analysis
  • Proprietary component replacement
  • Software supply-chain analysis
  • SBOMs
  • API dependency analysis
  • Reproducible builds
  • Self-hosted alternatives
  • Architecture for vendor portability
06 / SECURITY

Security & Cryptographic Control

Control the security primitives your systems depend on.

We help with

  • Cryptographic architecture
  • Key management
  • Secrets management
  • Access architecture
  • Security reviews
  • Penetration testing through our specialist network
  • Identity security
  • Infrastructure security
  • Dependency risk analysis
  • ISO 27001 readiness
03

identity is where we go deepest

Identity decides who can sign in, who can prove what, and which vendor has to be online for either to happen.

Our team has worked on wallets, issuers, verifiers, verifiable credentials and decentralized identity across enterprise, research and multi-stakeholder environments. We build on open standards such as OpenID4VCI, OpenID4VP and SD-JWT VC, and on self-hostable infrastructure such as Keycloak, so the identity layer can outlive any single provider.

OpenKYC, our own work on reusable, privacy-preserving verification, is built the same way.

Identity should be infrastructure, not a vendor trap.

Explore Digital Identity & EUDI Explore OpenKYC
04

from dependency analysis to implementation.

STAGE 01

Sovereignty Assessment

A focused technical assessment of your existing architecture. Short and concrete: an entry point, not a consulting programme.

We analyze

  • Infrastructure
  • SaaS
  • AI
  • Data
  • Identity
  • Software dependencies
  • Security
  • Supply chain
  • Regulatory requirements

Deliverables

  • Dependency map
  • Sovereignty risk matrix
  • Critical dependency list
  • Exit difficulty analysis
  • Architecture recommendations
  • Prioritized roadmap
STAGE 02

Sovereignty Architecture

We design the target architecture: what stays, what becomes portable, and what gets replaced.

May include

  • Infrastructure redesign
  • Cloud portability
  • Identity architecture
  • Private or local AI
  • Open-source replacements
  • Migration strategy
  • Data architecture
  • Security architecture
STAGE 03

Sovereignty Engineering

We implement it, with the same senior engineers who did the assessment and the architecture.

For example

  • Build the software that is missing
  • Migrate infrastructure
  • Integrate identity standards
  • Deploy self-hosted systems
  • Implement local or private AI
  • Replace proprietary dependencies
  • Build integration layers
  • Create custom tooling

We do not stop at PowerPoint. We build the systems we recommend.

05

regulation sets requirements. engineering meets them.

GDPR, NIS2, DORA, the Cyber Resilience Act, the AI Act and related EU regulation often define what an architecture has to guarantee: where data may go, how incidents are contained, what a supplier failure may take down, which components need a software bill of materials.

We work on both sides of that line. Our compliance specialists turn the requirements into controls, policies and processes: gap analyses, data classification, data protection impact assessments, AI policy and readiness for ISO 27001 certification. Our engineers build the architecture and the code that meet them.

We do not certify and we do not give legal opinions. Certification comes from an accredited body, and we will tell you when a question belongs with your legal team.

Explore Governance, Risk & Compliance
06

we build what we recommend

Our team's experience includes 30+ enterprise projects across identity, distributed infrastructure and security, in enterprise, public sector and research environments, including work before su.engineering was founded.

We also run our own products and maintain open-source software, so we meet the same dependency decisions from the inside.

PRODUCT / LIVE

Velum

Privacy infrastructure for AI. Velum masks personal and sensitive data on the device before it reaches an AI model, then restores it in the reply.

Local processing and data boundaries around third-party AI, shipped to real users.

Explore Velum
PRODUCT / APPROACHING LAUNCH

OpenKYC

Reusable identity and age verification built on verifiable credentials rather than repeated document and biometric collection.

Open standards, interoperable wallets, no identity silo.

Explore OpenKYC
OPEN SOURCE

Open-source software

We publish and maintain libraries on GitHub, including keycloak-oid4vp, a Keycloak extension for OpenID4VP wallet login.

Depending on open source well is easier when you also maintain it.

Explore our open-source work
07

where this becomes useful

  • 01Map which vendors your product cannot run without
  • 02Plan an exit from a single cloud provider
  • 03Move sensitive workloads to European or self-hosted infrastructure
  • 04Replace a proprietary identity provider with standards-based identity
  • 05Run AI on your own infrastructure or behind a provider abstraction
  • 06Keep encryption keys under your own control
  • 07Produce SBOMs and understand your supply chain
  • 08Get ready for an ISO 27001, NIS2 or DORA review
  • 09Replace a closed component with an open-source alternative

what does your stack depend on?

Start with a focused dependency assessment, or bring us a specific migration, identity or AI problem.

You don't need a finished specification to start.

Talk to an engineer Book a quick meeting
hello@su.engineering