More than 60% of Brazil's digital workload is still processed outside the country. This figure alone summarizes the scale of the challenge that data repatriation represents for the country's sovereignty. The Sovereign Cloud—the government cloud structured by the Ministry of Management and Innovation in Public Services in partnership with Serpro (Federal Data Processing Service) and Dataprev (the public entity managing social security systems)—has advanced rapidly since its launch in June 2025 and already serves over 250 federal executive agencies. This is a tangible achievement. However, it coexists with internal contradictions that compromise state cohesion and a structural vulnerability that no data center can solve on its own: the issue of cryptographic keys, the mechanism that defines who effectively controls access to data. Understanding what is already protected, what is currently being integrated, and what is still missing is the necessary step to honestly assess where Brazil stands in this race for digital independence.
What the Sovereign Cloud is and why it represents a milestone for the country
The Sovereign Cloud, formally titled the Government Cloud, is a data storage and processing infrastructure operated directly by Brazilian public companies, with physical servers located within national territory and subject to the Brazilian legal framework, specifically the LGPD (General Personal Data Protection Law). It was structured through a partnership between the MGI (Ministry of Management and Innovation in Public Services), Serpro, and Dataprev, aiming to ensure that sensitive State data is handled under national jurisdiction, complying simultaneously with the LGPD and the LAI (Access to Information Law).
The model adopted by Brazil combines two axes of sovereignty. The first is data sovereignty: all storage and processing occur in Brazilian data centers under national legislation. The second is operational sovereignty: management is 100% state-led, conducted by Serpro and Dataprev, even when the physical infrastructure utilizes equipment from major international manufacturers installed within the processing centers of these state-owned companies.
This arrangement clarifies a frequent misconception in the digital sovereignty debate: the idea that having a physical server in Brazil is enough to guarantee data control. It is not. Sovereignty is defined not by the location of the hardware, but by who operates it and which law it answers to. Consuelo Rodrigues analyzes this initiative as a necessary foundation for the state's digital governance, rather than a final solution. The Sovereign Cloud seeks to ensure that management remains in the hands of the Brazilian State and that data responds to the national legal framework, strengthening both citizens' rights and strategic national interests. What is still missing is institutional cohesion, a point I detail further below.
The digital heritage of Brazilian citizenship already protected by the Sovereign Cloud
The data that has already migrated to processing and storage under the Sovereign Cloud constitutes what I consider the digital heritage of Brazilian citizenship: records that underpin the daily lives and fundamental rights of tens of millions of people.
GOV.BR, the federal government's digital identity platform, houses 170 million users and provides simplified access to services across multiple government levels, from digital driver's licenses to online income tax returns. Dataprev supports CadÚnico (Unified Registry for Social Programs), a system with 96 million records that serves as the operational pillar for Bolsa Família, Unemployment Insurance, and other pension and social security programs. These are joined by critical data from the SUS (Unified Health System), the Federal Revenue Service, and the new Tax Reform platform.
Protecting these databases within an infrastructure under state control is not merely a technical decision. It is a governance decision with direct implications for the dignity and autonomy of citizens. Imagine the consequences of a geopolitical instability affecting access to these platforms: people unable to access social benefit histories, taxpayers without access to tax returns, patients without updated health records. This is not a distant hypothesis. It is the concrete risk that data concentration in infrastructures under foreign jurisdiction represents, and it is exactly this risk that the Sovereign Cloud seeks to mitigate.
What is entering now: courts, the MPU, and the 20% target
The progress of the Sovereign Cloud is not limited to the Executive Branch. All superior courts and the MPU (Federal Public Prosecutor's Office) have already joined the environment, signaling that the initiative has gained institutional breadth beyond direct federal administration.
Currently, 11 federal agencies are in the active process of migration, targeting what I consider an ambitious and necessary goal: repatriating 20% of state data to national infrastructure. This target itself demonstrates the magnitude of the work ahead. If only 20% is the immediate benchmark, it means the majority of the Brazilian State's informational capital is still managed beyond the government's direct reach.
Integration among migrated agencies is another strategic element of this process. The IND (National Data Infrastructure) organizes standards and technologies to expand interoperability between government databases, ensuring that cloud migration does not result in isolated silos but in an integrated, auditable, and secure ecosystem. Serpro and Dataprev jointly invested BRL 324 million in modernization in 2024, aiming to ensure the technical capacity to absorb this growth with high quality. Serpro recorded its highest historical profit during this period—BRL 685 million—part of which was applied to expanding the computational infrastructure supporting the Sovereign Cloud.
The problem no data center can solve: cryptographic keys and the Cloud Act
It matters little if the data resides in Brazil if the keys to the house are in foreign hands. This is the central premise that must guide any serious analysis of digital sovereignty, and it becomes even more urgent when we examine the role of the Cloud Act in the current geopolitical landscape.
The Cloud Act (Clarifying Lawful Overseas Use of Data Act) is a US law enacted in 2018 requiring technology companies headquartered in the United States to provide, upon court order, data under their custody regardless of where it is stored in the world. This means that data stored on a server located in Brazil, if under the operation of a US company such as Google, Microsoft, or Amazon, can be legally requested by the US government without any consultation with the Brazilian government. The physical location of the server becomes irrelevant: what matters is the nationality of the company operating it and, consequently, the law to which it is subject.
Cryptographic keys are the mechanism that allows the service owner—in this case, the Brazilian government—to maintain effective control over its own data even when the provider is a foreign company. If the government holds the keys, the provider cannot access the data content without authorization. If the keys are in the provider's hands, sovereignty is illusory: the data may be physically in Brazil, but control belongs to another jurisdiction. Ensuring that cryptographic keys remain under state control is, therefore, a non-negotiable requirement of any real data sovereignty strategy.
Internal contradictions compromising state cohesion
There is a paradox that must be clearly named. While the federal government advances in building the Sovereign Cloud, agencies such as the GSI (Institutional Security Cabinet of the Presidency) and the MEC (Ministry of Education) have negotiated or are still negotiating the transfer of sensitive data directly to foreign commercial clouds. The GSI itself moved forward with a Technical Cooperation Agreement with Amazon AWS, a US company directly subject to the Cloud Act, opening a vulnerability flank in the very agency responsible for the state's institutional security.
This contradiction is not an operational detail; it is a problem of State cohesion. Digital sovereignty is only real when all agencies follow the same strategic direction, with the same understanding of which data can migrate where and with what safeguards—the technical and contractual measures that ensure effective data protection. When one agency advances within the Sovereign Cloud while another negotiates contracts with US Big Tech without equivalent cryptographic control guarantees, the result is a sovereignty policy with structural gaps.
The problem is not using technology from international companies. The Sovereign Cloud itself uses equipment from global manufacturers, installed in Serpro and Dataprev data centers under state management. The critical difference lies in who operates it and which law the service answers to. The challenge Brazil faces now is institutional: ensuring that the decision on how and where to handle sensitive State data is a governance decision—coordinated, auditable, and linked to clear sovereignty criteria—rather than a fragmented, agency-by-agency decision lacking a collective vision.
Frequently Asked Questions about the Sovereign Cloud and digital sovereignty
Q: What is the Brazilian Sovereign Cloud?
The Brazilian Sovereign Cloud, also known as the Government Cloud, is a data storage and processing infrastructure operated by Serpro and Dataprev, with physical servers in national territory and 100% state management. Structured by the MGI, the initiative has been available since June 2025 to over 250 federal agencies, ensuring that sensitive state data is handled under Brazilian jurisdiction in compliance with the LGPD.
Q: What is the Cloud Act and why does it represent a risk to Brazil?
The Cloud Act is a US law that compels US-based tech companies to provide data in their custody to authorities, regardless of where the servers are located. This represents a risk because much of Brazil's infrastructure is operated by US companies. Without cryptographic control by the Brazilian government, US authorities could potentially access this data without consulting Brazil.
Q: What are cryptographic keys and why are they important for data sovereignty?
Cryptographic keys are access control mechanisms. If the government holds the keys, the cloud provider cannot read the data content without authorization. Sovereignty is only real if the keys are managed by the data owner; if the provider holds them, control ultimately belongs to the provider's jurisdiction.
Q: Which government data is already protected by the Sovereign Cloud?
Currently, the Sovereign Cloud protects strategic databases like GOV.BR (170 million users) and CadÚnico (96 million records), alongside critical data from the SUS, Federal Revenue, and the Tax Reform platform. Superior courts and the MPU are also part of this environment.
Q: Why is over 60% of Brazil's digital workload still abroad?
Historically, agencies and companies opted for international providers due to cost, technology availability, and scale. High energy costs make operating data centers in Brazil more expensive, leading to a structural dependency on Big Tech and exposure to extraterritorial laws.
Q: What is still needed for Brazil to advance consistently in digital sovereignty?
It requires institutional cohesion. While some agencies advance with the Sovereign Cloud, others hire foreign clouds without proper safeguards. Brazil needs a binding governance directive for all agencies, combined with the goal of repatriating at least 20% of state data to national infrastructure.
The infrastructure for Brazil's digital independence already exists. The Sovereign Cloud is a reality, growing and housing the digital records of fundamental rights for millions. What is missing is not technology, but State cohesion: the institutional resolve to treat data sovereignty not as a single ministry’s agenda, but as a binding policy for all agencies and sensitive data categories. A nation that does not control its informational capital is permanently exposed to pressures that no diplomacy can resolve once a breach has occurred. Governing data is, above all, defending the dignity of citizens, the country's autonomy, and the continuity of services that sustain fundamental rights. This is the commitment that digital sovereignty demands from all professionals and managers in the field.