The verdict in three sentences
For a citizen request app serving a Berlin district of around 80,000 to 300,000 residents, hosting costs 600 to 2,500 EUR a month in 2026 depending on the sovereignty level chosen. A BSI C5-attested or sovereign European cloud costs 20 to 40% more than standard cloud, but shields the administration from extraterritorial laws and is increasingly expected in German public tenders. Migration runs 8,000 to 20,000 EUR over 3 months, provided the tender requires a reversibility clause from the start.
Which sovereignty level for which data
A public sector IT lead handles very different data: street repair reports, civil registry requests, social benefit files, school enrolments. Not all need the same level, but an app combining identity, address and family situation must be treated as sensitive under the GDPR and the Berlin data protection act.
| Offer type | 2026 examples | Indicative monthly cost (EUR) | Legal protection | Suitable for |
|---|---|---|---|---|
| Non-European public cloud, Germany region | AWS Frankfurt, Azure Germany West Central | 450 - 1,500 | Subject to the US CLOUD Act | Public data, information sites |
| Standard European cloud | OVHcloud Public Cloud, Scaleway, Hetzner | 500 - 1,600 | EU law, no specific attestation | Common personal data apps |
| European cloud with BSI C5 or ISO 27001 | OVHcloud, IONOS Cloud, STACKIT | 600 - 1,900 | EU law, regular audits | Social services data |
| Sovereign cloud (SecNumCloud or equivalent) | Outscale, OVHcloud sovereign offers, Delos Cloud | 800 - 2,500 | Immune to non-EU laws | Sensitive data, registry e-services |
| Public IT service provider | ITDZ Berlin, Dataport | 400 - 1,200 | Public control | Berlin administrations |
| In-house hosting | Administration server room | 300 - 900 excluding staff | Full, but security to prove | Small volume, strong ops team |
In-house looks cheap but ignores on-call, cooling, off-site backups and system engineer time, often 0.3 to 0.5 FTE.
What the switch really costs
| Migration item | 2026 range (EUR) | Duration |
|---|---|---|
| Audit of current setup and data flow mapping | 1,500 - 3,500 | 2 weeks |
| Containerisation or app adaptation | 2,500 - 7,000 | 3 to 5 weeks |
| Infrastructure as code, staging and production | 1,500 - 4,000 | 2 weeks |
| Data migration and recovery tests | 1,000 - 2,500 | 1 to 2 weeks |
| Penetration tests and security sign-off (BSI IT-Grundschutz) | 1,500 - 3,000 | 2 weeks |
| Total | 8,000 - 20,000 | 3 months |
For a German administration, the security concept usually follows BSI IT-Grundschutz, with a risk analysis and formal approval by the head of the authority.
Clauses to put in the tender
Require data and backups located in Germany or the EU, a reversibility clause with full export in an open format within 30 days, at least 99.9% availability with service credits, the GDPR sub-processor list, and a ban on access from third countries without written consent. The EVB-IT contract templates provide a solid base.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Julia, IT lead of a Berlin district office, currently hosts the citizen request app with a US hyperscaler for 1,100 EUR a month. The data protection officer recommends sovereign hosting because the app processes social services requests.
- Chosen sovereign offer: 1,450 EUR a month, +32%, or 4,200 EUR more per year.
- Migration: 14,000 EUR including security sign-off.
- On-call saving: the offer includes 24/7 monitoring, removing a 350 EUR a month managed services contract.
Net annual running surcharge: 4,200 - 4,200 = 0 EUR. The only real cost is migration, spread over a 4-year contract, 3,500 EUR a year, roughly 0.01 to 0.04 EUR per resident per year.
FAQ
Is BSI C5 mandatory for a Berlin administration? Federal bodies are expected to use C5-attested cloud services, and Länder authorities increasingly follow suit. In 2026 it is a de facto requirement in most public cloud tenders.
Is a US cloud with a Frankfurt region enough? It guarantees location, not legal immunity. The CLOUD Act lets US authorities request data from a US provider wherever it is stored.
How long does a hosting switch take? About 3 months for a containerised business app, including 2 weeks of recovery testing. Without containers, expect 4 to 5 months.
Can we use a framework agreement? Yes, frameworks via the Kaufhaus des Bundes or public IT providers avoid a full tender and save 2 to 4 months.
How do we guarantee reversibility? Write a full export within 30 days in open formats into the contract, and build on standard technologies (Kubernetes, PostgreSQL, S3 storage) rather than proprietary services.
Let's scope your project. Describe your app, its data and your current hosting: we will cost the migration between 8,000 and 20,000 EUR and a target monthly cost, with a 3-month plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
