Zscaler and Schwarz Digits, the tech arm of the company that owns Lidl and Kaufland, have launched a joint cybersecurity platform running entirely out of German data centers, and the backstory behind who’s building it matters almost as much as what they built.
The service combines Zscaler’s Zero Trust security architecture with STACKIT, Schwarz Digits’ own cloud platform, creating a security setup that stays fully inside German infrastructure under German operational control. It targets organizations in sectors like public administration, defense, financial services, and healthcare, industries where compliance rules increasingly dictate not just how data gets protected, but where it physically lives and who can access it.
That distinction has become a bigger deal across Europe lately. Regulations like NIS2, DORA, and the EU’s AI Act have pushed boards to start asking questions that used to sit outside cybersecurity discussions entirely: which legal jurisdiction governs a vendor’s cloud infrastructure, and can a foreign government compel that vendor to hand data over. For Zscaler, partnering with a European sovereign cloud provider offers a way to keep selling Zero Trust security to public sector and regulated customers who can’t sign off on infrastructure sitting under, say, US jurisdiction.
Schwarz Digits itself is a somewhat unusual player in this space. It grew out of Schwarz Group’s internal technology operations, the systems the company originally built to run Lidl and Kaufland’s massive retail and logistics networks, before Schwarz decided to sell those same capabilities to outside customers. That’s roughly the same path Amazon took with AWS, just on a European scale and with a very different starting industry. STACKIT has been positioning itself as a genuine alternative to AWS, Azure, and Google Cloud, though it’s unlikely to pull major workloads away from the hyperscalers across the board any time soon.
Sovereignty alone rarely wins a deal on its own, though. Global cloud providers keep expanding their own European sovereign offerings, so enterprises evaluating this partnership will still weigh it against factors like developer tooling, AI capabilities, and pricing, not just where the servers happen to sit. Still, as AI-assisted attacks grow more sophisticated and automated, European enterprises are finding it harder to treat security architecture and infrastructure ownership as separate decisions.
