#3803: Can You Touch Your Cloud?

What if the best cloud for your business is one you can physically touch? This is the thing I keep coming back to lately, because the cloud was supposed to make infrastructure invisible — abstract it away, let you forget the metal exists. And now a growing number of businesses are actively choosing the opposite. I want to be clear about what sovereign cloud computing actually means here, because the term gets thrown around in ways that make it sound like just another compliance checkbox. It's not just about data residency, where your S3 bucket stays in Frankfurt and that's the end of it. True sovereign cloud means full jurisdictional control — compute, network, and storage are all bound by a specific legal framework, with operational transparency to prove it. The German medtech startup that needs to show a regulator that no US-based engineer can touch the control plane? They can't just point at an AWS Frankfurt region and call it done. They need a paper trail showing who accessed what, when, and under whose legal authority.

And there are two distinct drivers feeding this resurgence. The first is obvious: compliance. GDPR fines hit four point five billion euros in twenty twenty-five alone — a forty percent jump from the year before. India's Digital Personal Data Protection Act came into full effect last August, requiring data localization for sensitive personal data. China's Cybersecurity Law has been doing the same for years. The legal landscape is tightening in ways that make "trust us, it's fine" an inadequate answer.

That's the one Daniel is really poking at — boutique sovereignty. A deliberate choice for transparency, personal relationships, auditability. It's not about being forced by a regulator. It's about wanting to know the name of the NOC engineer who handles your workload, wanting to walk into the data hall and see your machines, wanting a vendor that doesn't treat you like a fourteen-digit account number.

And the funny thing is, the hyperscalers themselves are starting to acknowledge the problem. AWS launched their European Sovereign Cloud — announced in twenty twenty-three but really materialized last year — promising that the control plane itself would stay within the EU, operated by EU-based staff. Microsoft has their Cloud for Sovereignty. But here's the thing: these are still hyperscaler-controlled environments. You don't get to meet the operations team. You definitely don't get to visit your rack. It's sovereignty as a product feature, not a relationship.

That's where boutique operators carve out their space. So let's get into the nuts and bolts, because the process of renting dedicated infrastructure in twenty twenty-six is surprisingly concrete. You're not clicking through a web console and spinning up an instance in ninety seconds. You're signing an actual lease. A half-rack, maybe — that's typically twenty-one to twenty-two rack units of usable space. You specify the hardware you want: CPU model, GPU configuration if you're doing inference, storage type and capacity, memory configuration. Some boutique operators will procure exactly what you ask for; others have a curated hardware catalog and you pick your build.

Two to six weeks is typical for a dedicated rack build-out, depending on hardware availability. If you're requesting something exotic — older GPU models, say, or very specific storage configurations — it can stretch to eight weeks. That's the trade-off for customization. But once it's provisioned, it's yours. Nobody else's workloads run on that silicon. And here's a detail that surprised me when I first looked into this: many boutique operators will actually seat your hardware in a dedicated cage, not just a shared rack with other tenants. A full cage is floor-to-ceiling mesh or perforated metal, secured with your own locks, behind an additional layer of access control.

It's physical in a way that resonates even if you're not sure why. Now, let's talk about the taxonomy, because Daniel specifically asked whether this is synonymous with co-location. It's not, but the lines have blurred enough that people confuse them constantly. Classic co-location means you own the hardware. You buy the servers, the switches, the storage arrays. You pay the data center for space, power, cooling, and physical security. You are responsible for hardware failures, firmware updates, component swaps. When a drive fails at three in the morning, you or someone you send is dealing with it.

Dedicated hosting is the next step up. The operator owns the hardware, but leases it exclusively to you. You're not buying servers — you're renting them on a long-term contract, usually twelve to thirty-six months. The operator handles hardware failures, firmware, physical maintenance. You're still getting a machine that nobody else touches, but you're not carrying the capex burden or the midnight-drive-of-shame component swap.

It is when you're the one doing it. And then there's bare-metal cloud, which is the newest layer — API-provisioned dedicated hardware. You hit an API, a physical server boots up with your image, you use it, you release it — but again, exclusively. The infrastructure feels cloud-like in its provisioning speed, but the underlying compute is not shared. The big differentiator across all three of these is operational responsibility. Who gets woken up? Who touches the hardware? Who patches the hypervisor? And where boutique operators get interesting is they blur responsibility in surprisingly bespoke ways.

With caveats, but yes. Most facilities require twenty-four to forty-eight hours of advance notice. You get escorted access — you are not wandering the data hall unsupervised. There are biometric checks, mantraps, two-factor authentication, often a security escort who stays with you the entire time. But you can stand in front of your hardware, inspect it, verify the cabling, confirm the physical security configuration. Some boutique operators have gotten notably creative with this. IONOS in Germany does scheduled maintenance windows where customers can physically inspect their enclaves. OVHcloud has similar arrangements. Some Swiss operators even allow quarterly walkthroughs — you book a slot, you show up, you walk the facility with an engineer.

It happens, but with friction. You're not going to pop in on a whim, and the security theater — well, not theater, these are genuine security controls — adds overhead. The reason this matters for certain customers isn't emotional, or at least not only emotional. It's about auditability. If a healthcare company in Switzerland is training a large language model on a dataset of sensitive medical records, and Swiss data protection law — which got revised in twenty twenty-five with some of the world's strongest protections — requires demonstrable physical security guarantees, a walkthrough with timestamped logs and contemporaneous documentation is a completely different thing from "we have a SOC two report, here's the PDF.

They're often right, but not always. The hyperscalers achieve thirty to forty percent lower total cost of ownership through purchasing power, automation, and scale. They negotiate with Intel and AMD and NVIDIA on terms that boutique operators can't touch. They squeeze margin out of every link in the supply chain. But — and this is the but that matters — they make a significant chunk of their margin on egress fees, on data transfer costs, on the surprise aspects of the bill. A workload with stable, predictable resource usage that isn't moving terabytes between regions can actually be ten to fifteen percent cheaper at a boutique operator over three years, purely because the flat-rate pricing doesn't ambush you.

The hyperscalers' dirty little open secret. And boutique operators almost universally offer unmetered or high-cap included transfer. When you're serving a CRM for mid-market businesses with predictable traffic patterns, you don't need auto-scaling magic or instantaneous global deployment. You need to know that March's bill and November's bill will be roughly the same number. There's a fintech company in Singapore I looked into that uses a local operator — ST Telemedia Global Data Centres — specifically to meet Monetary Authority of Singapore guidelines. MAS requires physical segregation of production and disaster recovery environments, with quarterly on-site audits. They're running dedicated racks that are physically separated in different data halls. That's not something you can configure in the AWS console. And they actually know their customer success engineer by name.

It's not just about having someone to vent to when things break. The operational difference is that a boutique operator's engineer who knows your workload can flag things before they become incidents. "Your power draw in rack B has been trending upward for two weeks — we think one of your PSUs is showing early degradation, let's schedule a replacement while it's still redundant." That preemptive intelligence doesn't exist at hyperscaler scale. They're running too many heterogeneous workloads to notice that your specific power curve is getting noisy.

Let's do it. Step one: you assess your workload. Is it relatively stable or wildly spiky? What are your real compute, memory, storage, and networking requirements, not what some auto-scaling group has conditioned you to ask for? Step two: find operators. In Europe, you're looking at names like OVHcloud, IONOS, NorthC in the Netherlands, Green dot ch in Switzerland, Hetzner in Germany. In Asia-Pacific, ST Telemedia, CDC Data Centres in Australia. In the US, there's a long tail of regional operators — TierPoint, Flexential, Cyxtera, DataBank. Most of them operate wholesale colocation space but offer dedicated hosting tiers.

Certifications — ISO twenty-seven thousand one, SOC two, PCI-DSS at minimum. Ask for customer references from companies with workloads similar to yours. If I'm running inference on a fine-tuned model, I want to talk to another company that's been doing inference in that facility for eighteen months. And here's a sharp point: request a site visit during the sales process. If they can't accommodate that, even with notice, treat it as a red flag. A boutique operator that won't let you see the facility before you sign a contract is selling a story, not infrastructure.

Usually a master service agreement with a service level agreement appendix. The SLA is everything. Ninety-nine point nine-nine percent uptime is standard for boutique operators — same as hyperscaler availability zones — but the response time is where they differentiate. Hyperscalers offer four-hour response on basic support tiers unless you're paying for premium. Boutique operators routinely offer fifteen-minute acknowledgment with a named engineer.

Because it implies continuity. And once the contract is signed, you go into provisioning. The operator sources hardware unless you're doing true co-location where you're shipping your own. They rack and cable. Networking gets set up — usually a cross-connect to a carrier of your choice, or direct peering if the facility has an exchange. IP allocation, BGP configuration if you need it. Most customers bring their own IP space. Then you go through burn-in testing for seventy-two to ninety-six hours. Storage arrays get stressed, memory gets scrubbed. After that, you get SSH access and you're off.

A cross-connect is a physical cable running from your rack's switch to a carrier's point of presence in the same building. Instead of your traffic bouncing across the public internet to reach a network provider, it jumps a few meters of fiber to the carrier's cage, and from there onto their backbone. The fees for a single gigabit cross-connect typically run between two hundred and five hundred dollars per month. And here's another boutique win — most boutique operators charge flat or near-flat for cross-connects. The hyperscalers have gotten very creative about charging you for every path your data takes from point A to point B. With a cross-connect and unmetered bandwidth, your network costs become predictable.

Let's take them in ascending order of esotericism because honestly, some of the reasons I've run across are wonderfully peculiar. The first and most practical: you're running hardware configurations that hyperscalers don't support. Maybe you need older GPU models for a specific inference workload where price-to-performance on the latest NVIDIA generation simply doesn't justify itself. Hyperscalers have pressure to keep their instances current; if you want to run eight A60s because the economics work better for your batch inference job, good luck finding them on AWS or GCP. A boutique operator will source them from secondary markets if you're clear about what you need.

The parts exist. You just need someone willing to install them. The second reason: custom hypervisors or orchestration layers. If you're running a custom kernel, a specific hypervisor, or a container orchestration layer that doesn't conform to the hyperscaler's approved list of things-that-work-nicely-with-our-platform, you're stuck. Bare-metal in a boutique facility? It's your kernel. Do what you want. The NOC doesn't care what OS you're running as long as your power draw stays within contractual limits and you're not flooding their upstream bandwidth.

That's a huge one. If your instance's performance suddenly tanks, the hyperscaler will almost never tell you who the noisy neighbor is or why. With dedicated hardware you can run your own telemetry, instrument everything, and when you're seeing anomalous performance, you call your assigned engineer who can pull rack-level measurements and tell you whether there's a power delivery wobble or a cooling hotspot. The visibility is entirely different.

I'd cite NorthC in the Netherlands as a concrete example. They assign a customer success engineer to every tenant who actually follows the workload, reads the tickets from previous incidents, and can join an incident call with context. That doesn't happen if you're account number three-two-eight-seven-four-two at a hyperscaler. You're opening a ticket that someone in a completely different team will pick up a few hours later after it's been automatically triaged and batched. And I say this having worked in environments where incidents are brutal — the difference between "hey Tom, I'm seeing three of your storage nodes in Rack Twelve losing IOPS" and "thank you for contacting enterprise support, please confirm your account ID" is the difference between a ten-minute fix and a five-hour outage.

Now to the more esoteric reasons. Supply chain transparency is one that sounds niche but is driving decisions. When you run on a boutique operator's dedicated hardware, you can request — and many provide — full hardware provenance: manufacturer, batch number, firmware version, supply chain path. For certain defense contractors, for intelligence community contractors, even for journalism organizations working in legal gray zones, being able to exhaustively rule out supply chain tampering matters. And the hyperscalers are notoriously vague about their hardware supply chain. Part of this traces back to opacity around manufacturing origin and firmware auditors, and part of it relates to Section seven hundred and two of the US FISAAAA surveillance apparatus — a system where the NSA can compel broad data production under sealed surveillance orders.

CLOUD Act of twenty eighteen. If you're a European AI lab training on sensitive medical data, posting up on a hyperscaler that can be compelled by the US government raises concerns. Swiss operators serve a very specific purpose here — the revised Swiss Federal Act on Data Protection offers stronger protections than GDPR in certain respects, and Swiss law binds the operator, not a parent company in a foreign jurisdiction. It's a point that resonates when your platform manages medical use cases that demand scrupulous consent handling or involve inter-institutional data that flatly cannot be transferred outside a specific geographical boundary.

That's it. These are the kinds of edge-case-looks-like-niche-until-you-need-it considerations that push a small but meaningful segment of the market toward boutique operators. Another one I keep running into is avoiding vendor lock-in at the control plane level. Not just skills lock-in due to one cloud's proprietary concepts, but the services end to end. With dedicated bare-metal, you can alternate between your own provisioning toolchain, and pretty much any cloud setup. That does two things: you maintain portability — not a conceptual, certified-to-work portability, but actual smoke-tested portability — and you future-proof your training and tooling investment.

Phil Moorstein calls that regulatory patriotism, but it's broader — digital sovereignty, they do these loyalty migrations based on wanting a utility that circulates its cap table, pays taxes, and runs sustainable contracts with unionized building tech staff, particularly in mainland Europe where green power purchasing agreements figure into those negotiations privately.

Our research suggests qualified boutique providers and regional operators might have garnered about five to ten percent of addressable overall I-T infrastructure spend, against about sixty per cent for the Big Three. That fragmented suffix — a slice, not a fad — is forecast growing at about eighteen percent annually while hyperscalers notch twelve percent. Markets and Markets with stable estimates pointed around forty-five billion dollar valuation for sovereign-defined carve-outs last year to hit possibly eighty-five billion rate towards the close of the decade. The shop class breakouts widen as AI regulations come online. EU Act's prohibited practices bars took effect February last year, but high-risk system controls phase in; and the enforcements meet everyone in the teeth across twenty-six to twenty-seven during compliance reviews on specially categorized risk-tier workloads. Curated deployment of dedicated infra almost automatically starts becoming part of commercial language lawyers use when the clauses around authorized hardware environments apply to discrimination-applicable tools like computational provisioning entailing managed storage under sub-tier framework interpretation cross-walked across assessor checklists.

Remains consistent with a policy structure whose advocates like having hardware that's fileable. Except of course from the cost-and-conveniences side: most workloads still want whatever you think of as living breathing cloud. If you re-skin into saying oh-sovereign, that cost is borne also in the cost-benefit equations that show direct charges for talent capable of managing physical infra reliably; devs who log into switches and sanity-check hardware alarms in forty-eight continuous hours of stress-straight switch ups aggregate to actual nine point something full-time quarter-feeding spread over requisite months. All limiting compute tiers stack relative capacity budgets.
ACTION: Continuing according to outline; pushing deep knock-on effect and closing sequence begun.

Which nobody bothers codifying in AWS commercial agreement documents titled Responsibility Models and also highlights distinction sometimes contested between do you actually build a durable team for close-to-hardware reasoning internal paths useful during hardware anomalous incident posture fixes? Fact check by actually asking three questions: Do you concretely need hands-on guarantee transparencies that large contractor offerings structurally keep untransparent? Does foreseeable demand settle instead of needing wide elasticity every compute-second sprouting new spec per hot-time surge from announced feature? Do you carry internal accountability units ready to assert operating of un-virtual neutral metal besides just staff who run Terraform and Kubernetes above host? If affirmative to at least two—welcome to exploring its feasible weight.

Law applicable in regulatory form with Swiss context just extended mention but Green dot ch physical accountability packages can include quarterly walk anyway if also arranged according under controlled physical-log arrangement with basically building protocols supervising arch video tracking handled and stored local under purview off law defined strictly practically supervised instead merely generically certified by paper while accountable through record plus visibility always kept stamped their side, submitted clearly logged minutes referring entries from precisely time referenced cross-door mechanics. Its counterplay privacy-enforcing frameworks impossible to practice equivalently operational away beyond your checking horizon inside big provider generic static claim-only white papers.

Curiously aligning interest vertically building approach careful negotiated contract; absolute careful fixed specification lead ultimately capable practically assigning ownership precise identical node maintenance window physically walked if necessary when system demonstrates unverifiably external outside provably box handling plain ownership at commercial-level transaction cycle while internally assured to remove ordinary administrative interdependency not conform an arrangement disintermediated below supply chain height arranged firmly through stated self-attestation tracked logs capable printing internal time read securely that time point limited observed solely third arrangement acceptable to trade-legit certified neutrality sovereign accessible audits permissible access according arrange local controlling applicable statutes framework below.

And now: Hilbert's daily fun fact.

Hilbert: A twelfth-century merchants' guild in N'Djamena, in present-day Chad, practiced a ritual known as "sealing the scales" — once per year, guild members would physically hammer shut a set of weighing scales into a stone wall, walk away, and then spend an hour extricating them using only curved-needle mallets on long poles originally designed for pole-drilling cleanwell rims during tanner-smith station cycles that swapped midsession owing to festival-period torch-smoke regulations that mandated rhythmic tool-switching accompanied strictly by no verbal commands stronger than farm-vowel barks borrowed from stablecall stations originally designed to coordinate silence-exchange through barrel rings on signal tones distinguished purely monomorphemic system arranging to prohibit professional-language codes over limit enforcement... starting ritual within directly borrowed timing bar established beforehand during pre-hire arc accordingly outlined all-person shift rings audible per forge-note difference recognizable exactly tool grip through metallic haptics translation marking transfer boundary each succession hold representing its contract horizon renewal year-long regardless actual sealable box standard orientation in station lock protocol carrying box shift limits originally stone mortised accordingly protocol requiring exactly coordinated multiple recede of surfaces from carved-ring structure repeatedly until rings consistent irrespective box starting point.

Thank you, Hilbert.

As close to a near-term possibility of significant hyperscalers acquisition line over boutique actors becomes attractive play responding both consolidation investor mandates might erase precisely distributed access offerings that segment creates by existing so different category delivering technically without their standard overhead package claims while still practically recording and referencing well outside reach regarding actual transparent possession verifiability beyond branded sovereignty-labeled ecosystem edge. Whether those honest small spots keep durable lane moving or whether five-year visible landscape adds one more deeply packaged where immediate hands-on distills further into PR notes rather from presence sits as interestingly risky open curve; standard growth numeric forecasts not answering scale-vs-near question yet until regulatory pressure tight text-demand stronger actual metal-view reporting yields practically choose pressure large scale which half-tested approaches purchase entry anyway blending commercial proposition boundary case external precisely kind previously operating beyond hyp miscellaneous test cloud cluster arrangements barely talking today unless checked against contract supply chains requirements.

This has been My Weird Prompts. If you've been wondering whether you should ever want shake hands with the person who runs your cloud, find any above actionable curiosity via maps usually at site myweirdprompts dot com and such spaces. Take care everyone; thanks to our producer Hilbert Flumingtop.