Lock-in grows one convenience at a time. The buyers decide where it stops.
The company behind Lidl runs a cloud. Another retailer you may have heard of built its own some time ago.
Amazon began building its cloud, AWS, in 2003. Its storage service, launched in March 2006, offered developers the same storage "infrastructure that Amazon uses to run its own global network of web sites", as its launch announcement put it. Servers for rent followed in August. Both were basic parts any developer could put together.
Schwarz Group, which owns Lidl and Kaufland, began building its cloud, STACKIT, in 2018 for its own companies, with "protecting sensitive data" among the goals. It opened STACKIT to outside customers in 2022. "We did not start with a commercial motivation in mind but just wanted to address our own needs," Christian Müller, now CEO of Schwarz Digits, its IT division, told the Financial Times in 2024. In April 2026, the European Commission chose STACKIT as one of four providers in a sovereign cloud tender worth up to 180 million euros.
So how did Amazon's cloud become so hard to leave? Whether Amazon planned it or not, the lock-in arrived through things customers asked for. They wanted less work, so Amazon added services that did the work for them, such as a database it runs for you. It "frees developers from the headaches of provisioning hardware and software," Werner Vogels, Amazon's CTO, wrote at its launch in 2012. That database runs only at Amazon. Today Amazon lists more than 240 services, and the ones that exist only at Amazon make leaving harder.
STACKIT has already taken one step like this. Its customers ran their servers through the controls of OpenStack, an open-source project that other providers use too. A team that knew those controls could use them elsewhere. In January 2025 STACKIT made its own controls the standard, "not compatible" with the old ones, as its documentation puts it, and urged customers to move. Its reasons: one set of controls "for all infrastructure services", to "simplify some currently unnecessarily complex steps", and to offer services "outside the OpenStack domain".
Most of what STACKIT sells is still built on open-source software that other providers run too. That's why this is the moment to watch. In May 2025, Schwarz announced it was developing STACKIT "into a German Hyperscaler", a German counterpart to Amazon, Microsoft and Google.
A European provider can change whose law reaches your data. That's a real gain. It doesn't change how hard it is to leave. That depends on what you build on, and a provider builds what its customers ask for.
Sovereignty is three questions, and the flag answers only the first:
- Whose law reaches it?
- Can you leave?
- Could anyone but the vendor run it?
Amazon's customers built its lock-in one request at a time. STACKIT's customers are making their requests now. If you're one of them, ask the last two questions before you ask for the next convenience.
