Building Data-Sovereign IoT Platforms in Europe

Data sovereignty means your machine data falls under the laws of the jurisdiction where it physically sits, and that you, not a platform vendor, decide who can read it. For an industrial fleet that runs across Germany, France, and the Netherlands, that is not an abstract legal point. It determines whether a competitor's hyperscaler, a foreign subpoena, or a SaaS provider's bankruptcy can reach your runtime, fault, and location data.

The practical question a procurement officer asks is narrow: if the platform vendor disappears tomorrow, do we still have the data, the keys, and a way to read both? Sovereignty is the architecture that lets you answer yes. It touches three layers at once: where bytes are stored, where they are processed, and who holds the encryption keys.

Three instruments shape the build. GDPR governs any telematics signal that can be tied back to a person, and a vehicle's GPS track plus a driver roster is exactly that, so location and operator data carry personal-data obligations even on industrial equipment. The EU Data Act, in force since 2024, gives the user of a connected product the right to access the data it generates and to have it ported to a third party of their choosing, which means a closed gateway that hoards its own telemetry is now a compliance liability, not just a commercial one. Schrems II remains the reason EU-to-US transfers need real safeguards rather than a checkbox.

The design consequence is direct. Build so that data stays in the EU by default, so that the customer can extract it in a documented format on demand, and so that you can show an auditor where every signal lives and who touched it.

Sovereignty is easiest to defend when it is structural rather than a setting someone can flip. Pin the storage layer to EU regions explicitly: a Postgres or TimescaleDB instance in Frankfurt or Paris, object storage with a region lock, and backups that never replicate outside the bloc. Run the MQTT broker (Mosquitto or EMQX) on EU-hosted infrastructure or on the customer's own metal, so the telemetry stream itself never transits a third country.

Push as much processing to the edge as the use case allows. A gateway that aggregates J1939 engine data and Modbus sensor reads into one-minute summaries before transmission keeps most raw signal on-site, which shrinks both the bandwidth bill and the sovereignty surface: data that never leaves the machine cannot be subpoenaed in another jurisdiction. For the data that does move, encrypt it on the gateway with keys the customer holds, so even an EU-hosted broker only ever sees ciphertext it cannot read.

Open components are what make residency and portability verifiable instead of promised. With an open Linux gateway, Mosquitto for transport, and TimescaleDB for storage, every hop is inspectable and every region setting is one you control, not one buried in a vendor's terms. A closed platform can claim EU hosting; an open stack lets your auditor confirm it.

Portability stops being a project when the data model is open from the start. Expose a documented REST or SQL interface over the time-series store, keep schemas in version control, and the Data Act access right is satisfied by a feature you already shipped rather than a scramble when a customer invokes it. The same openness protects you against your own supplier: when the source, the schemas, and the keys belong to the customer, no single vendor's exit can strand the platform.

Compliance is a question you have to keep answering, so instrument the system to answer it without a fire drill. Log who accessed which dataset and when, in an append-only audit trail that survives the access it records. Tag each stream with its storage region so a residency claim can be checked, not asserted. Document the key hierarchy: which keys live on the gateway, which in the customer's HSM or KMS, and who can rotate them.

Regulations move, and the EU Data Act guidance is still settling. A system built on open formats and clear data contracts adapts to that movement; a closed one waits for a vendor release. Plan for the change rather than freezing against it.

A sovereign platform is less a product than a set of guarantees made concrete in code: EU-resident storage, EU or on-premise brokers, gateway-side encryption with customer-held keys, and a documented export path. Melqart Systems builds that path on open Linux gateways and an open-core data stack, then hands over the source, the schemas, and the credentials so the system runs without us.

The outcome a European operator wants is ownership that holds up under scrutiny: the data sits where the law requires, the keys sit with you, and an auditor's questions have answers that point at the architecture rather than a vendor's promise.