Codesphere’s €30.8M Win Puts Germany’s Cloud Under a Startup

The Tender That Changed the Map

Codesphere, a Karlsruhe startup founded in 2020, won a €30.8 million European government tender in 2024 for the MEDI:CUS and Deutschlandplattform contracts with GovTech Deutschland, as Elias Schneider's figures show. The award, part of an SVA-led consortium with Schwarz Digits for the BMDS KI-Plattform (the German federal AI cloud platform), makes a four-year-old developer-tool company a pillar of Europe's sovereign cloud buildout and reframes procurement when the specification demands independence from third-country control.

The BMDS KI-Plattform gives federal, state, and municipal authorities a shared AI infrastructure meeting German sovereignty requirements end to end. Codesphere contributes the platform layer, a virtual cloud provider built on Kubernetes that runs on any underlying infrastructure, while partners including enclaive supply Confidential Computing integration. The company says its system aligns with the "Deutschland-Stack" principles and accelerates complex legacy migrations from years to days. That claim matters because the sovereign cloud buildout is not a greenfield exercise; it must absorb existing workloads across fragmented public-sector IT landscapes.

The procurement pattern signals a structural shift. For years European governments defaulted to US hyperscalers for cloud capacity, then layered sovereignty requirements on top through contractual addenda. The BMDS KI-Plattform tender inverts that logic: sovereignty is the procurement decision, not a retrofit. SVA's announcement framed it explicitly: "Souveränität ist eine Vergabeentscheidung." The award followed Codesphere's earlier €30.78 million win for the same contracts with GovTech Deutschland, Codesphere reported. Separately, a €250 million BMDS-PaaS contract for the sovereign AI cloud platform was awarded to a consortium led by T-Systems and SAP, Codesphere found. By September 2026 the company added an €80 million framework contract to provide the development and product platform for ITZBund, the federal government's central IT authority, Codesphere's data shows. The company disclosed this was the largest tender ever awarded directly to a European software startup.

Google and adesso withdrew procurement complaints in late 2026 regarding the BMDS-PaaS award, clearing the path for that shared infrastructure, but the operational test comes when municipalities migrate workloads onto a stack that has never run at that breadth. Codesphere's platform layer will be measured on whether it delivers the migration speed it claims. If it does, the award becomes the template for the next wave.

Why Sovereign Cloud Is Booming

Europe's sovereign cloud market hit USD 27 billion in 2024 and is projected to reach USD 322 billion by 2035, a compound annual growth rate of roughly 25 percent. Forecasts cluster tightly: Grand View Research sees USD 192 billion by 2033; Fortune Business Insights measures the global market at USD 155 billion in 2025 and forecasts USD 1.32 trillion by 2034, with Europe holding 36 percent; Acumen Research sizes the European segment at USD 46 billion in 2025 and sees USD 363 billion by 2035. Germany led the region with 21 percent share in 2024 and is on track for a USD 28 billion national market by 2032. The UK, France, and Spain trail at 17, 14, and 10 percent share respectively, with Spain growing fastest at nearly 25 percent annually.

The numbers reflect a regulatory architecture that has hardened into procurement law. The German coalition agreement of April 2025, titled "Germany – Digital. Sovereign. Ambitious.", mandates open interfaces, Europe-wide standards, and strategic advancement of open source across public and private actors. The Federal Ministry for Digital Transformation and Government Modernisation (BMDS) is building a high-performance German cloud infrastructure on those principles. Open source is no longer a preference; it is a contractual requirement.

At the EU level, the Data Act, GDPR, and DORA have converged to make data residency a compliance condition, not a feature. The European Data Protection Board has ruled that encryption and pseudonymisation are insufficient when the cloud provider holds the keys. The US CLOUD Act extends jurisdiction over any data in a US provider's possession, custody, or control regardless of where the bits sit. That legal reality has turned "EU-hosted" offerings from AWS, Microsoft, and Google into a contested category. Isolation without key control does not satisfy regulators.

The policy signal now carries procurement muscle. The European Commission awarded an €180 million tender under the Cloud III Dynamic Purchasing System in October 2025. Four consortia won, measured against a Cloud Sovereignty Framework with eight objectives spanning strategic, legal, operational, and environmental dimensions, plus supply chain transparency, technological openness, security, and EU law compliance. Providers had to reach at least SEAL-2 (Data Sovereignty), meaning they abide by EU laws without requiring customers to add technical protections. Three of the four winner groups cleared SEAL-3 (Digital Resilience), demonstrating immunity from non-EU supply chain disruption.

The Commission awarded four contracts in parallel to avoid single-provider lock-in. This was a deliberate diversification strategy that also signals the market's maturity. As Henna Virkkunen, the Commission's EVP for Technological Sovereignty, Security and Democracy, said: "Scaling the use of EU cloud is key to strengthening Europe's digital sovereignty."

OVHcloud, the French infrastructure veteran, anchors the Post Telecom consortium alongside CleverCloud. OVHcloud owns and operates its own data centers, designs much of its own hardware, and has long positioned itself as the sovereign reference for European SMEs and public sector buyers. Its CEO, Octave Klaba, called the award proof that "when European players unite their strengths they make a difference." OVHcloud also holds a subcontract on the European Central Bank's digital euro project and a prior Commission contract. This track record was explicitly rewarded by the tender.

STACKIT, the cloud brand of Schwarz Digits (the technology arm of the retail giant behind Lidl and Kaufland), won its contract independently. Built on enterprise infrastructure developed in Germany, STACKIT represents a new class of sovereign provider: backed by a non-tech conglomerate with deep capital and a strategic imperative to control its own stack. Its SEAL-3 rating confirms the platform meets the Commission's highest current assurance tier for operational resilience.

Scaleway, the Iliad Group subsidiary, also secured a standalone award. Its GPU-heavy infrastructure serves AI workloads for customers including Mistral AI. CEO Damien Lucas framed the economics bluntly: "For every euro spent with Scaleway, around 68 cents are reinvested in the European economy, compared to around 20 cents when relying on international hyperscalers." That reinvestment ratio, 68% versus 20%, has become a rallying metric for native providers arguing that procurement choices compound into industrial capacity.

T-Systems, Deutsche Telekom's enterprise arm, was not among the four Cloud III winners but is executing a parallel sovereign buildout. Its T Cloud platform, launched at Digital X in Cologne, pursues a multi-cloud strategy organized around "levels of sovereignty" rather than a single stack. By end of 2026, T-Systems says T Cloud Public will significantly close the feature gap with US hyperscalers in core capabilities while delivering scalable infrastructure and specialized AI services from German data centers. The telco's scale and existing public-sector relationships make it a de facto member of the sovereign cohort regardless of the Cloud III outcome.

The Cloud III award draws a line between sovereign operation and sovereign technology. It concludes the former can compensate for the latter if governance controls are sufficient. That line runs straight through the Proximus–S3NS award. S3NS is a Thales–Google Cloud joint venture where Thales holds a controlling stake but the underlying infrastructure comes from an American company. CISPE, the European cloud providers' trade association, warned before the award that the framework's weighting could let well-resourced non-EU players qualify despite falling short on the most fundamental criterion. Legal jurisdiction accounts for only 10% of the sovereignty score. The Commission responded: "Non-European technologies, when operated within a strict and appropriate framework, can meet the minimum level of sovereignty required."

Government and defence buyers represent 38 percent of adoption; banking and insurance another 20 percent; healthcare, at 12 percent, is the fastest-growing vertical. Data sovereignty alone captures 48 percent of functionality spend; operational sovereignty takes 30 percent. IaaS dominates the service model at 55 percent, with private deployment at 50 percent today and hybrid rising to 37 percent by 2035.

This is a structural reallocation of infrastructure spend driven by law, geopolitics, and the operational reality that foreign-controlled clouds cannot meet European compliance requirements.

The Hyperscaler Countermoves

AWS dropped €7.8 billion on a single German state. The AWS European Sovereign Cloud launched its first region in Brandenburg on January 15, 2026, after a two-year buildout creating a physically and logically separate cloud infrastructure. It features a distinct partition (aws-eusc), distinct region (eusc-de-east-1), and distinct legal entity. Three German GmbH subsidiaries sit under a new European parent company. All managing directors are EU citizens residing in the EU: Stéphane Israël, appointed October 2025, and Stefan Hoechbauer, added January 2026. Technical controls block access from outside the EU. No critical dependencies on non-EU personnel or infrastructure exist. The region opened with more than 90 services, including Amazon SageMaker and Amazon Bedrock for AI workloads. AWS says the investment will contribute €17.2 billion to German GDP through 2040 and support roughly 2,800 full-time equivalent jobs annually in local businesses.

Microsoft took a different route. In Germany, Delos Cloud, an SAP subsidiary, operates a sovereign cloud for the public sector built on Microsoft Azure and Microsoft 365. Delos Cloud, Microsoft, and Arvato Systems signed final contracts for the platform; Arvato Systems runs operations. The arrangement meets the Bundesamt für Sicherheit in der Informationstechnik (BSI) Cloud Platform Requirements. National Partner Clouds sit at the center of Microsoft's sovereign cloud strategy: independently operated environments delivering Azure and Microsoft 365 capabilities under local ownership and control. Google Cloud, by contrast, maintains European regions under its standard US corporate structure and has not announced a fully separate sovereign infrastructure.

The debate cuts to what "sovereign" actually means. AWS calls its approach "sovereignty through isolation": a fully featured, independently operated cloud backed by technical controls, sovereign assurances, and legal protections designed for European governments and enterprises. Critics argue isolation is necessary but not sufficient. The European Data Protection Board has stated that technical measures alone (encryption, pseudonymisation) are insufficient if the cloud provider holds the encryption keys. The US CLOUD Act explicitly reaches data in a US provider's possession, custody, or control regardless of storage location. Legal experts contend that true data control starts with ownership and management of infrastructure: as long as Europe rents technology from third countries, independence remains limited. European customers often interpret trust as independence from unilateral control, not merely technical security.

Level 1 sovereignty requirements, focused mostly on data residency, are achievable by hyperscalers. But the EU Cloud and AI Development Act, if enacted, would require public bodies to assess sovereignty risks and procure cloud services meeting four assurance levels. The higher tiers demand contractual reversibility, hardware provenance, and governance that no US-headed corporation can fully satisfy while remaining subject to US law. AWS bets €7.8 billion that European enterprises will pay premium pricing for sovereign hosting versus standard regions. Microsoft bets that a partner-operated model satisfies enough public-sector buyers to hold ground. Both are racing to lock in workloads before native European providers close the feature gap.

Inside the Codesphere Buildout

Karlsruhe, 2020. Three founders started Codesphere from a city better known for its federal courts than its startup scene. Elias Schneider, Jonas Zipprick, and Roman Frolov launched the company. Schneider had written code since he was ten and spent time at Google before striking out on his own. The team operated fully remote from day one, a decision that looked prescient when the pandemic hit months later. Their bet: developers shouldn't need DevOps expertise to ship features. The platform they built lets engineers write, test, and deploy directly in the browser, with infrastructure autoscaling in near real time and a "pause and resume" model that separates compute from storage. This cuts costs for sporadic workloads, including AI inference.

The funding trajectory mirrors the product ambition. An $18 million Series A closed in May 2024, led by Creandum with LEA Partners, Begin Capital, 42CAP, and 468 participating. Angel investors from Shopify, Google Cloud, and DigitalOcean joined. Total capital raised reached $26.5 million. Creandum's Carl Fritjofsson called it "one of those incredible opportunities with almost unlimited upside." He cited appeal across traditional enterprises modernizing legacy stacks, scale-ups needing elasticity, and individual developers wanting speed without infrastructure debt.

The platform's architecture reflects a deliberate sovereignty-first philosophy. It runs as a virtual layer across public cloud, private cloud, on-premises, and air-gapped environments. This is a single control plane that doesn't care where the metal sits. That flexibility caught L-Bank (Staatsbank Baden-Württemberg), which integrated Codesphere into its transformation strategy to become "the most digital development bank in Europe," said CIO Nino Messaoud. Tel.io, Eurotours, and Gigabyte round out the disclosed customer base, spanning regulated finance, telecom, and travel.

The €30.8 million GovTech Deutschland tender win, where Codesphere provides the platform layer for the same contracts, validated a product built for exactly this moment: German public sector buyers needing EU-hosted, EU-controlled infrastructure that still delivers modern cloud ergonomics. The company's own LinkedIn description now reads: "Our platform gives enterprises and governments full sovereignty without giving up modern cloud capability." A vision recently validated by a series of multi-million European government tenders.

Hiring signals confirm the pivot from developer tool to sovereign infrastructure provider. EngRadar tracks 16 open roles as of the latest count, with three net additions in the past 28 days. First-party board data shows the most recent postings: Technical Bid Manager in Karlsruhe, Software Engineer Working Student in Karlsruhe, Senior Security and Compliance Engineer in Munich, Senior Account Executive in Karlsruhe, Senior Backend Software Engineer in Karlsruhe, and a (Senior) Product Manager for Deployments in Karlsruhe. The Technical Bid Manager role is the tell. Sovereign tenders demand specialized proposal engineering, compliance mapping, and evidence packages that generalist sales teams can't produce. Hiring for it means Codesphere is building a repeatable motion for the regulated public sector, not chasing a one-off contract.

Offices in Karlsruhe give them physical presence in the DACH corridor where procurement decisions land. Schneider, now a Forbes 30 Under 30 honoree, frames the mission bluntly: "Complexity kills speed. By simplifying cloud infrastructure, we help organizations move faster, stay flexible, and remain sovereign." The next tender cycle will test whether that simplicity scales.

The Talent Implication

Europe's sovereign cloud buildout is colliding with a talent shortage that was already structural before the first tender landed. The EU employed over 10 million ICT specialists in 2024, roughly 5.1% of total employment, double the 2014 figure. Yet the Digital Decade target calls for 20 million by 2030. That gap of nearly 10 million workers in six years is not a hiring plan; it is a deficit that sovereign cloud projects will widen.

More than 55% of EU enterprises that tried to recruit ICT specialists in 2024 reported difficulty filling those positions, up from 46% two years earlier. Eurostat puts unfilled ICT vacancies above 1.2 million by late 2024, with projections pushing past 1.4 million for 2025. Germany alone will lose an estimated 7 million workers from its working-age population by 2035, and IT competes with every other sector for the same shrinking pool.

Sovereign cloud adds a new layer of specificity to the shortage. Regulations like NIS2, DORA, and the EU AI Act are creating demand for hybrid compliance-technical roles that simply did not exist two years ago. Cloud security engineers now take 90–120 days to fill. Platform engineers and DevOps architects run 80–110 days. AI/ML engineers stretch to 100–140 days. For senior software engineering roles generally, the average time-to-fill across Europe is 67–85 days, nearly three months, roughly double non-technical professional roles.

The sovereign cloud tier is even tighter. Job boards show dedicated postings for Senior Sovereign Cloud Architect, Senior Cloud Solution Architect for Sovereign Cloud, and Senior Solution Architect for Sovereign Cloud PoC at the European Parliament. These roles demand fluency in EU data residency rules, encryption key management, and the operational isolation models that differentiate a genuine sovereign cloud from a hyperscaler's "EU region" marketing. Microsoft's sovereign cloud hiring specifies "deep understanding of cloud architecture, compliance frameworks, and data sovereignty regulations in Europe." RED Global's equivalent role requires "proven experience" in the same stack.

Codesphere's own hiring trajectory reflects the shift. As of August 2026 the company lists 16 open roles across backend, product, DevOps, and full-stack engineering, plus a Senior Security and Compliance Engineer in Munich and a Technical Bid Manager in Karlsruhe. First-party board data shows Codesphere added that Technical Bid Manager role in the past week, alongside a Software Engineer Working Student, a Senior Account Executive, a Senior Backend Software Engineer, and a (Senior) Product Manager for Deployments. The cluster signals a company moving from product build to regulated delivery at scale.

University curricula trail industry needs by two to four years. Cloud-native security, LLMOps, and platform engineering are barely represented in most European computer science programs. Graduates often need six to twelve months of intensive upskilling before they can deploy Kubernetes clusters, fine-tune large language models, or architect zero-trust frameworks. Meanwhile, remote competition has globalized the salary benchmark: European engineers now access US and UK remote packages, making it harder for mid-sized European firms to compete on base pay alone.

The response is shifting from posting harder to structuring differently. Skills-first hiring is mainstream. Take-home coding challenges, system design interviews, portfolio reviews, and micro-certifications from AWS, Google Cloud, or specialized bootcamps increasingly replace degree requirements. Mercer's 2025 guidance finds winning packages combine learning budgets (€2,000–5,000 annually), flexible working, stock or profit sharing, mental health benefits, and conference sponsorship. WEF and EU data show smart companies train existing staff rather than fight the external market: structured 6–12 month reskilling programs with guaranteed role transitions, particularly converting infrastructure staff into cloud security or platform engineering roles.

Nearshore is no longer a cost play; it is a capacity play. Western European companies are establishing development centers in Poland, Romania, the Czech Republic, and the Baltics. Poland produces over 60,000 IT graduates annually, Romania's sector has grown at double-digit rates for a decade. Portugal and Spain attract international talent through favorable visa regimes. The Netherlands serves as a hub for international consultants despite its own domestic shortage.

For sovereign cloud specifically, the implication is clear: the talent pipeline will not catch up to the tender calendar. Companies that treat hiring as a procurement exercise will execute. They multi-source across permanent hires, freelance specialists, and managed service providers. They decouple roles from unicorn job titles. They accelerate procurement cycles so that a 90-day vacancy doesn't stall a €30 million delivery. The rest will watch their sovereign cloud commitments slip.

The BMDS KI-Plattform goes live in 2027. When the first municipality migrates a legacy workload onto Codesphere's layer, the test isn't technical. It's whether a procurement model built on sovereignty as a decision criterion, not a retrofit, can scale across a federation that has never run a shared stack at this breadth. The award now has to prove it works.

Working in frontier tech? Zero G Talent tracks the openings: see every open Codesphere role, browse frontier tech jobs, the companies hiring, and the people building the field.