Compliance and data sovereignty for the public sector.
Institutional email hosted in the EU (Portugal), demonstrable GDPR compliance and communications with proof of sending and delivery, with EU invoicing and a team that answers from Portugal.
- European hosting
- GDPR compliance
- EU invoicing
Requirements met
What a public body needs to guarantee.
Four common tender specification requirements, met from the outset.
European hosting
Citizen and employee data on servers located in Europe, under exclusively European jurisdiction.
GDPR compliance
Full traceability and compliance documentation to respond to audits and data subject requests.
EU invoicing
EU-based company, EU VAT number, invoicing in euros. No non-European intermediaries in the procurement process.
Registered Email
Official notifications and communications with proof of sending and delivery, admissible in court.
Digital sovereignty
Citizens' data should not depend on transatlantic agreements.
EU-US data transfer frameworks have already collapsed twice and face a new challenge. For a public body, the simplest answer is structural: data in Europe, exclusively European jurisdiction, no transfers.
The European context
Europe's public sector is already reducing its dependence.
France, Italy, Germany and the Netherlands have taken concrete steps in recent years. Others, such as Portugal, have approved national plans whose implementation is still years away. Public bodies do not have to wait for them to protect their email.
France
Since 2021, the "Cloud au centre" doctrine has reserved state systems holding sensitive data for qualified clouds (SecNumCloud) that are immune to non-European laws. This halted the migration of ministries to American cloud suites, including email.
Italy
Italy's Cloud Strategy (Strategia Cloud Italia) classifies public data (ordinary, critical, strategic) and created the Polo Strategico Nazionale: critical and strategic data live on qualified infrastructure under national control, with hundreds of administrations already on board.
Germany
In 2025, the state of Schleswig-Holstein migrated the email of its entire administration (more than 40,000 mailboxes) from Exchange/Outlook to open solutions, and the federal government is developing openDesk, a sovereign workplace for public administration.
The Netherlands
In 2025, Parliament passed a series of motions to halt unnecessary migrations of government IT to American cloud providers, require exit strategies and launch a sovereign state cloud.
An example: Portugal
National plans exist. Implementation will take years. Email does not need to wait.
Portugal, for example, has approved a National Sovereign Cloud Plan, with data classification planned by 2027 and infrastructure by 2030: official recognition that today's dependence is a risk. But no public body needs to wait until the end of the decade to protect its most critical communication: institutional email can move now to European infrastructure, subject exclusively to EU law, with assisted migration and no service interruption.
Institutional trust
Public bodies that already trust Sooma.
The Municipality of Murtosa entrusts its email to Sooma. In domain management, the list includes the Municipalities of Almada and Coimbra and the Instituto de Informática, I.P. And the Portuguese Bar Association (Ordem dos Advogados), a public-interest institution with thousands of users, manages its mailboxes on our infrastructure.
Paperless
Administrative notifications with proof of sending and delivery, without paper.
Meeting notices, notifications and official communications with proof of sending and delivery, with a qualified timestamp (eIDAS, Art. 43): instant, and at a fraction of the cost of paper.
Frequently asked questions
Before signing up
What public bodies ask first.
Can our organisation's emails be accessed by authorities in other countries?
If they are hosted with providers subject to the laws of third countries, yes: legislation such as FISA Section 702 and the CLOUD Act allows US authorities to demand data from American providers, even when the servers are in Europe and without the knowledge of the organisation concerned. At Sooma, data is subject exclusively to European law: any access is only possible under the law of the EU member state where it is stored, with judicial oversight.
And matters subject to confidentiality: disciplinary proceedings, health data, non-public information?
This is where the risk weighs most. When communications live outside European jurisdiction, the duty of confidentiality no longer depends solely on the organisation: it comes to depend on decisions by foreign authorities, taken without its knowledge. With data in Europe, administrative secrecy and the confidentiality of proceedings are protected by the European legal framework, with no extraterritorial exceptions.
Where is residents' and service users' data kept?
On servers in Europe, subject exclusively to the GDPR and EU law, with no transfers to third countries.
Is there an availability SLA?
Yes, 99.9% availability guaranteed by contract.
Does migrating from the current system interrupt the service?
No. Data is copied without deleting the source, and the current service keeps running until the switch has been validated, with the team supporting you from planning to go-live.
Talk to us before your next procurement procedure.
Proposal, documentation and proof of concept, straight from our team in Europe.