The verdict in three sentences
A public body's information website does not always need a certified sovereign cloud, but services that process sensitive citizen data do. A hybrid architecture works well: the main portal on a managed EU-owned cloud at 500 to 1,200 EUR a month, and sensitive e-services on a certified sovereign offer at 1,500 to 3,000 EUR a month. A migration budget of 4,000 to 10,000 EUR and a disaster recovery plan with a 24-hour RPO belong in the decision, not just the monthly fee.
The Dutch and EU policy context
Sanne, CIO of a regional public agency in Amsterdam, must renew hosting for its public portal and three e-services: permit applications, subsidy requests and incident reporting. The Dutch government cloud policy requires a risk assessment before using public cloud, and the BIO baseline (Baseline Informatiebeveiliging Overheid) sets security controls for all government bodies. At EU level, the NIS2 directive, transposed through the Dutch Cyberbeveiligingswet, raises the bar for public administration, and concern over extraterritorial laws such as the US CLOUD Act pushes buyers towards EU-owned providers.
In practice, classify each service. The information portal (news, opening hours, board members) holds little personal data. Subsidy requests hold income data. Permit applications hold identities and plans. Only the last two justify certified sovereign hosting.
The three options compared
| Criterion | EU-owned VPS | Managed EU cloud | Certified sovereign offer |
|---|---|---|---|
| Monthly price 2026 | 60 to 150 EUR | 500 to 1,200 EUR | 1,500 to 3,000 EUR |
| Location | Netherlands or EU | Netherlands or EU | Netherlands or EU, certified operator |
| System management | No, your responsibility | Partial (managed databases, Kubernetes) | Yes, per contract |
| Extraterritorial protection | EU-owned company | EU-owned company | Contractual and certified guarantee |
| Certifications | ISO 27001 | ISO 27001, BIO alignment | ISO 27001, BIO, sovereign label |
| Suited to | Simple information site | Portal and standard e-services | Sensitive citizen data |
| Internal skills required | High | Medium | Low to medium |
A 90 EUR VPS looks unbeatable, but it requires a sysadmin able to patch, back up and monitor. If that work takes 2 days a month valued at 600 EUR a day, the real cost reaches 1,290 EUR a month.
CDN, disaster recovery and migration: the forgotten items
| Item | Recommendation | 2026 ballpark |
|---|---|---|
| EU CDN | EU-established provider with Dutch points of presence | 30 to 200 EUR a month |
| Off-site backups | Second data centre, 30-day retention | 50 to 150 EUR a month |
| DR plan, 24 h RPO and 8 h RTO | Daily replication, procedure tested twice a year | 200 to 700 EUR a month |
| Portal and e-service migration | Inventory, cutover, testing, 48 h content freeze | 4,000 to 10,000 EUR |
| Post-migration security audit | Targeted penetration test | 4,000 to 8,000 EUR |
| 24/7 monitoring | Uptime and certificate alerts | 80 to 250 EUR a month |
A 24-hour RPO means accepting the loss of at most one day of submissions after a disaster. For permit applications with statutory decision deadlines, a 4-hour RPO is safer and raises replication cost by about 30 %.
How to write the tender
Split the tender into two lots: lot 1 for the information portal, lot 2 for sensitive e-services. Require data and backup location in the EU, no exposure to extraterritorial law for lot 2, documented reversibility with data export within 30 days, and a security assurance plan aligned with BIO. Weight it: 40 % technical value and security, 30 % four-year price, 20 % reversibility and DR, 10 % support. The four-year price prevents picking a low monthly fee with a ruinous migration.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Sanne prices the hybrid architecture over 4 years. Lot 1 on a managed EU cloud at 750 EUR a month, plus CDN at 90 EUR and backups at 80 EUR: 920 × 48 = 44,160 EUR. Lot 2 on a certified offer at 2,100 EUR a month, plus DR at 450 EUR: 2,550 × 48 = 122,400 EUR. Migration and audit: 8,000 + 6,000 = 14,000 EUR. Total: 180,560 EUR. Putting both lots on the certified offer would cost about 4,200 EUR a month, 201,600 EUR plus migration, so 215,600 EUR. The hybrid approach saves about 35,000 EUR without weakening protection of sensitive data.
FAQ
Must a Dutch public body use a sovereign cloud?
Not for every service, but BIO, NIS2 and the government cloud policy require a documented risk assessment, which usually leads to certified hosting for sensitive data. An information portal can stay on an EU-owned managed cloud at 500 to 1,200 EUR a month.
What counts as sovereign hosting?
An EU-owned provider, EU data location and contractual protection from extraterritorial laws. Certified offers add independent audits and typically cost 1,500 EUR a month or more.
How much does a hosting migration cost?
For a portal and three e-services, expect 4,000 to 10,000 EUR, with a 48-hour content freeze. A security audit adds 4,000 to 8,000 EUR.
Which RPO fits a public sector website?
A 24-hour RPO suits the portal. For e-services with statutory deadlines, aim for 4 hours, at about 30 % extra replication cost.
Is an EU CDN necessary?
Yes, to absorb traffic spikes during storm alerts or subsidy windows, often 10 times normal load. An EU CDN costs 30 to 200 EUR a month.
Let's scope your project. We classify your services, compare providers and plan the migration of your institutional website, on a custom quote, with a timeline that fits your procurement cycle. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
