We map systems, data flows and dependencies before planning the move. The migration is carried out with testing, rollback and an agreed cutover. Timeline and any planned service impact are determined after the assessment.
Many Swedish SaaS companies and fintechs chose AWS or Azure because it felt secure, scalable and cheap. But the regulatory landscape has changed radically – and US cloud providers are subject to American legislation regardless of where the data is physically stored.
NIS2 (the cybersecurity act) came into force on 15 January 2026 and affects a large number of Swedish operators in designated sectors. Customers and procuring organizations may require documented data flows, supply chains and processing locations – the supply chain is an audit point.
DORA (Digital Operational Resilience Act) applies to financial entities and requires management of ICT risk, ICT third-party risk, contracts and exit strategies. The regulation does not mandate a specific hosting country, but concentration risk towards a single US hyperscaler must be justifiable and managed.
More procurements require showing where data is stored and processed. US legislation such as the CLOUD Act is one reason many reduce their dependence on US providers. The exact legal assessment depends on the whole contract and provider chain and is best made together with your legal function.
A common objection is "but we use managed services in AWS". Here is how the most common services map to sovereign equivalents in our data center.
| In the US cloud today | With us in a Swedish data center |
|---|---|
| EC2 / Azure VM / Compute Engine | Virtual machines on our VMware/KVM platform – same OS, same applications, often better performance per krona |
| RDS / Azure SQL / Cloud SQL | PostgreSQL, MySQL or SQL Server as a managed database – we handle patching, backup and replication |
| S3 / Blob Storage | S3-compatible object storage in the data center – your applications often only need a new endpoint and new keys |
| EKS / AKS / GKE | Kubernetes clusters that we operate – your manifests and Helm charts work as before |
| CloudWatch / Azure Monitor | Monitoring stack with alert chain – included in Managed EU Drift |
| Route 53 / Azure DNS | Redundant DNS operations – or you keep your external DNS provider |
Serverless services (Lambda, Functions) and proprietary PaaS services require rebuilding – this is captured in the assessment with a time estimate per service, so you know exactly what moves as-is and what needs adaptation.
A structured exit – not a risky lift-and-hope project.
Fixed price, fixed delivery in 3 business days. You get decision material you can take to the board – and a plan that can be executed immediately.
| Time | 3 business days |
|---|---|
| Cost | Fixed price SEK 15,000 excl. VAT – credited in full against a booked migration within 60 days |
| Next step | The migration takes from approx. 2 weeks depending on the scope of your systems |
Three days from start to decision material.
We map which systems you have (applications, databases, APIs, storage), where your data resides right now (region, provider, replication), which data flows are most sensitive (PII, financial information, customer data) and which compliance requirements you already meet or must meet. Deliverable: a detailed environment description.
The systems are mapped against NIS2/DORA and your industry regulations, gaps are identified (e.g. encryption at rest but not in transit) and we build a step-by-step plan: what is migrated first (low-risk systems), what is migrated last (critical databases), which tests are required and how long systems may be offline – if at all.
We present the decision material, a quote for migration and operations (Managed EU Drift), and propose a timeline. You set the pace – the migration typically starts within 1–2 weeks.
We never migrate everything at once. Each step is verified before the next begins, and a rollback plan is in place the whole way. The goal is minimal planned service impact.
Check of hypervisors, network configuration and security. Cryptographic verification of all volumes and databases. Redundancy test – can the system handle a failure during an ongoing migration?
Each virtual machine is copied from AWS/Azure to our data center: exact disk image (byte-for-byte), bootloader and kernel intact, network remapped to our switches. Each machine is verified to boot correctly before the next is moved. Order: test systems first, production systems during low load, full traffic last.
New IP addresses in your dedicated VLAN, your existing firewall rules reproduced, VPN tunnels to offices and partners set up as needed. DNS is updated gradually – not all at once – to avoid cache problems.
Traffic is switched over outside business hours. We monitor 24/7 during the first week. If anything goes wrong, traffic is sent back to your old environment in under 15 minutes.
| Planned downtime at cutover | Typically a few minutes for DNS-based cutover; set in the migration plan |
|---|---|
| Total time to "everything in a Swedish data center" | From approx. 2 weeks depending on the scope of your systems |
| Rollback | Back to the old environment in < 15 minutes, throughout the entire migration period |
After the migration you receive the three documents that reviewers, auditors and procurement teams ask for.
Certificate that your data is stored physically in Sweden in our data center according to the agreed architecture. Supporting material you can attach in procurements and audits. Remote access, support and any integrations are documented separately.
Legal agreement covering GDPR (we act as your data processor when we process personal data on your behalf), sub-processor requirements, incident notification within 24 hours and your right to audit us – at any time.
All system changes are logged (who, what, when), access logs for everyone touching your data, documented security updates and a monthly updated status for the agreed control and documentation requirements.
Fixed price per package – you know the cost before we start. The Sovereignty Assessment costs SEK 15,000 and is credited in full against a booked migration within 60 days.
< 50 GB data, 5–10 VMs
50–500 GB data, 10–50 VMs
> 500 GB, 50+ VMs or multi-region
Cutover is planned outside office hours with an agreed impact level. If the planned time is exceeded we cover extended support.
Not satisfied within 30 days? We restore your systems to your old environment and refund the migration fee.
Throughout the migration period you have a dedicated engineer on your team – plus 30 days of burn-in support after go-live.
Prices are indicative, excl. VAT. Post-migration support and knowledge transfer to your IT team are included, followed by an optional transition to Managed EU Drift.
Illustrative scenario based on an anonymized customer. Actual outcome varies with the scope of your systems and dependencies – we're happy to share details in a call.
A typical migration takes 2 weeks for a small system (< 50 GB, 5–10 VMs) and 3–4 weeks for larger environments. We always migrate in stages: non-critical systems first, production systems last.
We plan the cutover outside office hours and aim for minimal impact. For a typical DNS-based cutover this means a few minutes of propagation. The actual planned service impact depends on your architecture and is set in the migration plan before we carry out the move.
The Sovereignty Assessment costs SEK 15,000 excl. VAT and is credited in full against a booked migration within 60 days. The migration costs from SEK 50,000 for a small system and from SEK 150,000 for a medium system. Larger environments are quoted separately.
Every migration has a documented rollback plan. Expected recovery time, decision point and technical limitations are set after the assessment and tested before the production cutover. Any refund terms are stated in the quote and the agreement.
You receive data residency documentation, a data processing agreement and auditable logs that can be used in your NIS2, DORA and GDPR work. Responsibility for the overall assessment of your operations, applications, processes and supply chain stays with you.
We choose the replication and cutover method based on the database and your RPO target. Where the architecture supports it we can plan for RPO 0 at cutover. The exact target, verification method and rollback conditions are documented and tested before the move.
No. We migrate in stages and can run hybrid during the transition. Many customers start with their most sensitive systems and move the rest in phases.
Yes. Managed databases are moved to the equivalent managed service with us (PostgreSQL/MySQL/SQL Server) and S3 is replaced with S3-compatible object storage – your applications usually only need a new endpoint and new keys. Serverless functions require rebuilding, which is time-estimated in the assessment.
It remains untouched until you have approved that everything works in the new environment. We then help you decommission the old environment in a controlled manner. Export, retention and deletion are documented according to your instructions, applicable retention requirements and the agreement with the previous provider.
Minimally. VMs, containers and databases work as before. CI/CD pipelines are repointed to the new environment – that's included in the migration. Kubernetes manifests and Helm charts are reused as-is.
Yes – that's our service Managed EU Drift: patching, backup, 24/7 monitoring and technical input for your NIS2 incident reporting from SEK 5,000/mo. 30 days of stabilization support is always included after the migration, whether or not you choose managed operations with us.
One call is enough for us to give you an initial picture of your exit path – with no obligations.