Why data confidentiality remains guaranteed with Zivver – and how sovereignty is further strengthened through our partnership with Kiteworks

Why data confidentiality remains guaranteed with Zivver – and how sovereignty is further strengthened through our partnership with Kiteworks

Posted by Rick Goud on 23rd June 2025

Concerns around data sovereignty and dependency on U.S.-based cloud providers are more pressing than ever. Organizations – especially in the public sector – rightly ask: how do we maintain control over our data in a world where technology, legislation, and geopolitics are increasingly intertwined?

Strengthening data sovereignty and control over sensitive communications was one of the key motivations behind the partnership between Zivver and Kiteworks. This blog explains how that step not only preserves Zivver’s existing safeguards, but further reinforces them – by clearly outlining:

Two risks that are often conflated

In many discussions around U.S. cloud providers, different concerns are often lumped together. This leads to confusion – and sometimes to ineffective mitigation strategies. In reality, there are two fundamentally different risks, each with its own legal context and technical countermeasures.

By making this distinction explicit, it becomes clear why certain measures (such as encryption or using EU data centers) may mitigate one risk – but not the other.

  1. Data access under the U.S. CLOUD Act

The CLOUD Act grants U.S. authorities the power to compel U.S. companies to hand over customer data – regardless of where that data is physically stored. This means that even data stored in European data centers may be subject to access, as long as the provider is under U.S. jurisdiction.

The risk lies not in where the data is located, but in who has authority over it.

What does work:

  1. Encryption where only the customer has access to the encryption keys.

If the provider cannot access or deliver the keys, the data remains inaccessible – even in the event of a legal request.

  1. Self-managed environments (on-premise or private cloud).

When the software is run locally or within an organization’s own European cloud, and the provider has no access to infrastructure or keys, it simply cannot comply with data access requests – even if legally compelled.

  1. Service disruption due to geopolitically driven sanctions

The U.S. government can require technology companies to block access to their services for specific organizations or countries. Recent cases – such as Microsoft disabling accounts of the International Criminal Court at the request of the Trump administration – show that this risk is no longer hypothetical.

What does not work:

  1. Encryption alone is insufficient.

Even if the data is well encrypted, services can still become unusable if access to the software itself is blocked.

  1. Storing data in EU-based data centers does not offer protection.

Service disruption occurs at the operational level (accounts, access rights), not based on physical data location.

What does work:

  1. Avoid dependency on U.S.-controlled operational infrastructure.

This includes identity services, update mechanisms, licensing systems, and cloud platforms managed by U.S. entities.

  1. Use software that can function fully autonomously.

Only solutions that can run locally or in a European private cloud – without reliance on external authentication, licensing, or hosting services – remain usable under political pressure or sanctions.

How Zivver addresses these risks – Already for data access, and soon for service continuity

Zivver is built on the principle that sensitive communications should be accessible only to the sender and recipient – regardless of where or by whom the solution is hosted.

✅  Zero-access encryption

All messages sent or stored via Zivver are encrypted in such a way that:

Even when Zivver uses infrastructure such as AWS, these environments are technically excluded from accessing keys or content. As a result, the risk of data access via the CLOUD Act is effectively mitigated in practice.

✅ Self-hosting as the next step: Private cloud or on-premise

Zivver is currently developing a version of its solution that offers even more protection, enabling organizations to:

This means organizations will be protected not only against external access but also against potential service disruptions imposed by third parties.

How the partnership with Kiteworks enhances what organizations need

Kiteworks provides a platform for the secure sending, receiving, sharing, and editing of sensitive files and messages – including through email, MFT (Managed File Transfer), SFTP, and web forms. Like Zivver, Kiteworks is fully focused on protecting confidential communication, with a strong emphasis on compliance, data control, and auditability.

Kiteworks’ technology expands Zivver’s capabilities by enabling us to:

Rather than compromising on sovereignty, this partnership allows us to deliver sovereign solutions at scale, with greater functionality – while remaining fully independent of U.S. cloud infrastructure.

Conclusion

Zivver – especially in partnership with Kiteworks – provides structural protection against the two main risks associated with U.S. cloud providers:

The collaboration with Kiteworks enables Zivver to support organizations in their pursuit of true data sovereignty – without compromising on usability, compliance, or security.

Rick Goud
CIO & Founder
Published: 23rd June 2025