Thirty million euros a year. That’s what the European Commission’s sovereign cloud framework works out to once you divide the headline €180 million by its six-year term. I keep putting that number next to another one: US cloud providers pour some €10 billion every quarter into European capex, which Synergy Research’s chief analyst called an impossible hill for anyone trying to challenge them seriously. Brussels is fighting a forest fire with a garden hose. The interesting part of this week’s news is that the Commission seems to know it, and bought something other than more water.

Cycloid, a Paris-based internal developer portal and platform company, will be the developer-facing portal for the Commission’s new sovereign cloud framework, giving up to 5,000 Commission developers unified access to cloud services from four European provider groups. Those four emerged from an April award. The tender launched in October 2025 as a competition under the Commission’s Cloud III Dynamic Purchasing System, and on April 17 the contracts went to Post Telecom with partners CleverCloud and OVHcloud, to STACKIT, to Scaleway, and to Proximus, which partners with S3NS, Clarence and Mistral. The framework decides who EU institutions can buy from. Cycloid becomes the layer through which Commission developers reach and manage those services without dealing with each provider separately.

A lot of the coverage frames this as a startup “fresh off its Series A,” and that’s where I had to stop and check. The round is nineteen months old. Cycloid raised a €5 million Series A in February 2025, led by Reflexion Capital with five French angels, bringing total funding to €8 million after an initial €3 million round in 2020. At the time, it had around 25 employees across Europe and North America. So this isn’t a hot new raise meeting a hot new contract. It’s an eleven-year-old company, founded in 2015 by former Red Hat cloud executive Benjamin Brial, that has been quietly working its way into one of the most demanding public-sector buyers on the continent.

And it was already inside. This detail surprised me most, and it changes how I read the whole story. The Commission ran an in-house developer portal for nearly ten years before replacing it with Cycloid a year ago, and a separate agreement already lists Cycloid as a pre-approved supplier through the DIGIT software broker. Cycloid didn’t beat a field of giants in a cold tender. It became the plumbing first, then became the obvious answer when the plumbing needed to reach four new water mains. Anyone who has sold into government knows incumbency is worth more than any pitch deck, and a sub-€10M startup landing this kind of beachhead inside DG DIGIT is a better go-to-market story than most Series B decks I read.

Why does a developer portal matter for sovereignty at all? Because the uncomfortable truth European procurement has spent a decade avoiding is that where your data sits is only half the problem. Cycloid has been making this argument loudly all year, including in an “exit-by-design” reference architecture whose central claim is that data residency alone doesn’t deliver sovereignty; you have to control the whole software delivery control plane to survive the legal collision between the US CLOUD Act and GDPR. Put your workloads in Frankfurt, keep your CI/CD, secrets and portal wired into a US hyperscaler’s tooling, and you’ve bought the costume, not the thing. AWS demonstrated the gap this month when its new AI assistant skipped the very European Sovereign Cloud it built for this purpose. Brial compressed the whole argument into one line this week: “A sovereign cloud framework is only as sovereign as the choices it leaves open.”

That line matters more than it sounds because of how the four providers actually scored. To be eligible, providers had to reach SEAL-2, the Commission’s Data Sovereignty level. Post Telecom with CleverCloud and OVHcloud, STACKIT and Scaleway, which all develop their own technology, reached SEAL-3, Digital Resilience. Proximus/S3NS reached SEAL-2, drawing on partners working from a Google Cloud-based technical environment operated exclusively by EU companies. The Commission said out loud that non-European technologies, operated within a strict framework, can meet the minimum level of sovereignty required. I don’t think that’s wrong, but it does mean one of the four doors opens onto Google’s stack with a Thales badge on it (and a Mistral logo next to it, the same Mistral that now hosts Chinese open weights outright, which tells you how blurry these labels already are). When one supplier sits a full level below the other three, the abstraction layer above them stops being a convenience. It’s the escape hatch, and that’s the real job Cycloid was hired to do, whether or not the press release says so.

The market backdrop is grim enough that I’d understand Brussels grabbing any lever. European providers’ share of their own cloud market fell from 29% in 2017 to 15% in 2022 and has sat around 15% since, while Amazon, Microsoft and Google now hold 70%. The biggest European names, SAP and Deutsche Telekom, account for about 2% each. The “just trust the contractual guarantees” argument also took a hit when Microsoft France’s legal director conceded under oath that the company couldn’t guarantee French citizens’ data would never reach US authorities without explicit French authorization. Scaleway is leaning into the economics as hard as the law, claiming about 68 cents of every euro spent with it gets reinvested in the European economy, versus around 20 cents with international hyperscalers. I’d want to see the methodology before I repeat that one at a dinner party, but the direction is plausible, and it’s more concrete than most of what I heard when European AI sovereignty was still mostly a panel topic.

Where this gets structurally interesting is the policy wave that landed two months after the award. On 3 June, the Commission proposed the Cloud and AI Development Act, which would require public authorities to weigh “Union added value” as a non-price criterion when procuring cloud and AI services, and introduce an “open source-first” principle for public purchases of cloud and AI software. Read those two lines, then look at a French, self-hostable, air-gappable portal already sitting inside the Commission. CADA is still a proposal, and critics argue its highest sovereignty levels work as origin-based market restrictions rather than technical safeguards, a fight that will run through Parliament and Council for a while. But if it passes anything like its current shape, the Commission’s own setup becomes the template every national ministry gets pointed at.

Compare that with how the other two blocs handle the same problem. Washington doesn’t need a sovereignty framework because the hyperscalers are the sovereignty; the CLOUD Act simply extends US legal reach to wherever American companies store data. Beijing solved it years ago by decree: foreign clouds operate in China only through licensed local partners, which is why AWS runs there through Sinnet and NWCD and Azure through 21Vianet. India has gone for walls too, which I got into when Europe wrote its sovereignty rules into law while New Delhi built an air-gap. Europe is the only big player trying to get sovereignty through procurement design and portability rather than ownership or prohibition. It’s slower and far more fragile, and it’s also the only approach compatible with a market where European vendors hold 15%, and the buyer can’t afford to rip everything out.

The competitive picture is where I get nervous for Cycloid. The internal developer portal space is small, loud, and well-funded everywhere except Paris. Spotify’s open-source Backstage is the default build-it-yourself option, and Israeli startup Port raised a $100 million Series C at an $800 million valuation in December 2025, bringing its total funding to $158 million. Port grew out of its founders’ experience building a portal for the IDF’s Unit 8200, serving over 2,000 developers, and it employs around 200 people in Israel and the US. That’s roughly twenty times Cycloid’s lifetime funding in a single round. In an open commercial fight for Fortune 500 platform teams, I don’t love Cycloid’s odds. In a European public-sector fight scored on Union added value, self-hosting and supply-chain origin, the math flips, and that’s the niche Brial has clearly decided to own. Whether the niche is big enough to build a real company on is the question the next raise will have to answer. I’m not getting into the FinOps and GreenOps side of Cycloid’s pitch here; it’s a separate argument and frankly the less differentiated part of the product.

€30 million a year won’t move Synergy’s 15% line by a single decimal, and anyone selling this as Europe clawing back its cloud is overselling. What the Commission actually bought is a reversible architecture, with a French company holding the switch. The real test is boring and specific: sometime in 2027, can a Commission developer move a workload off the Google-based S3NS environment onto Scaleway or STACKIT through Cycloid without filing a ticket, waiting a quarter, or rewriting a pipeline? If yes, this is the most important €8M-funded company in European cloud policy. If no, it’s a very nice dashboard in front of the same dependency.

Sources