European organisations will soon be able to buy Zscaler’s cloud security platform through infrastructure operated in Germany, creating another route for regulated customers that want mature global software without placing every operational layer on a non-European hyperscaler.

Zscaler is working with Schwarz Digits, the technology division of the group behind Lidl and Kaufland, to run its Zero Trust Exchange on the STACKIT cloud. The service will be hosted in German datacentres and offered across Europe, with deployment, management, operation, and support handled within the region.

Public administration, defence, financial services, healthcare, and other regulated sectors are the initial target markets. Organisations in those fields are being asked to establish not only where information is stored, but who can administer a platform, which jurisdictions apply, how operational data moves, and whether critical services can continue when an overseas supplier changes its commercial or technical terms.

Zscaler remains an American software company, and a German hosting arrangement does not turn its platform into a European product. However, the partnership changes more than the location of customer records by moving the service onto infrastructure operated by Schwarz Digits rather than placing a European residency layer on one of the global hyperscalers.

Control extends beyond the server location

Cloud sovereignty is frequently reduced to the country in which storage systems are installed, although practical control travels through software updates, encryption keys, identity services, telemetry, support access, subcontractors, and incident response. A workload can remain physically inside Europe while depending on administrative functions elsewhere.

The Zscaler and Schwarz Digits architecture separates some of those layers. STACKIT supplies the underlying infrastructure, while the security service is operated from German facilities. The partners say customer data will remain in the EU and that the service is intended to align with European requirements concerning privacy, resilience, and digital sovereignty.

Contracts will determine how far that independence extends. Customers will need clarity over software development access, update approval, key management, service logs, emergency support, and the legal treatment of security telemetry. A security platform may process particularly revealing information about employees, applications, network traffic, and attempted attacks, making its operational data almost as sensitive as the systems it protects.

European regulation has strengthened the commercial case for architectures that provide clearer regional control. NIS2 and DORA have increased attention on operational resilience, third party exposure, and concentration, while public bodies are facing pressure to reduce dependence on a small group of infrastructure providers.

Europe is assembling a cloud stack through partnerships

Schwarz Digits has become a significant infrastructure operator because it combines a large internal customer, substantial capital, German datacentres, and a strategic incentive to reduce dependence on outside technology suppliers. STACKIT grew from the systems used by Schwarz Group companies before being offered to external customers.

Its partnership with Zscaler also reflects a persistent weakness in Europe’s cloud market. The region has credible infrastructure providers and datacentre operators, but fewer enterprise software platforms with the installed base and international scale of American vendors. Rebuilding every application layer domestically would be costly and too slow for organisations with immediate security requirements.

Running established software on European controlled infrastructure provides an intermediate route, although it can entrench the software supplier at the layer customers use most directly. The balance improves when customers retain access to their data, can replace components, and avoid proprietary dependencies that make the infrastructure interchangeable while leaving the application impossible to remove.

The European Commission’s proposed Cloud and AI Development Act seeks to expand computing capacity, improve access to suitable sites, and strengthen European control over digital infrastructure. Commercial arrangements such as the Zscaler deployment are likely to become part of that policy environment because sovereignty is being expressed through architecture and procurement rather than through ownership alone.

Zscaler gains access to tenders that may otherwise favour European vendors or privately operated infrastructure, while Schwarz Digits adds a mature security platform to a cloud ecosystem that needs applications and operational services as well as raw compute and storage.

Customers will ultimately judge the arrangement by what happens when the platform is updated, investigated, disrupted, or replaced. A German datacentre answers one sovereignty question, but the harder test concerns who retains practical control over the service when normal operations stop.