EU MSP Digital Sovereignty: Governed Script Execution Without US-Only Control Planes

European Union and EEA MSPs increasingly face buyer questions about digital sovereignty: reducing reliance on foreign-owned control planes for privileged automation, audit evidence, and operational data. Trustholm is a policy and evidence engine for MSP script governance-designed to run beside US RMM tools (NinjaOne, ConnectWise, N-able) rather than rip-and-replace the full stack.

This resource helps procurement teams, DPOs, and MSP vCISOs evaluate residency, subprocessors, and stack architecture without marketing sovereignty slogans.

Why privileged automation is a sovereignty conversation

US hyperscaler and RMM dominance means many EU MSPs route signed PowerShell, approval workflows, and script audit through vendors subject to extraterritorial law and geopolitical supply risk. EuroStack and national procurement discussions on regional hosting focus on infrastructure-but application-layer governance matters when assessors ask who can see script content, audit rows, and administrator identities.

Trustholm concentrates on governed execution with exportable proof: signing policy, tenant-scoped security audit, and schema-per-tenant isolation.

We do not claim full RMM replacement, open-source product status, or automatic compliance with every EU public-sector classification. We provide evidence for your control matrix and honest gap rows.

What typically resides in tenant data plane

Per-tenant PostgreSQL schema holds:

• Agent registration and inventory metadata
• Script library content and versions
• Security audit rows (privileged actions plane)
• Monitoring configuration when module enabled
• Portal user and role records

Classification depends on what technicians put in scripts-credentials should follow secrets hygiene regardless of residency. MSPs remain controllers for many processing purposes; Trustholm typically acts as processor for operational platform data.

Hosting regions (planned)

Govern is in early access. Australia is the planned first region. EU hosting (on an EU-based cloud provider) is by enterprise arrangement. Your home region is agreed in writing during onboarding.

The marketing site (www.trustholm.com) runs on Cloudflare's global network for trial forms only, with no tenant production data. Separate production subprocessors from marketing subprocessors in DPIAs.

Deployment options for sovereignty buyers

| Option | Best for | Notes | |--------|----------|-------| | Shared multi-tenant SaaS (EU region) | Mid-market MSPs | Schema-per-tenant on EU-hosted Postgres | | DedicatedDatabase profile | Regulated MSPs | Separate database instance per tenant | | Self-hosted / air-gapped (Enterprise) | Public sector, strict residency | by enterprise arrangement; not yet delivered to a customer |

See /govern/trust/downloads EU vendor pack and architecture overview for procurement packets.

US stack complement positioning

Pragmatic EU buyers often keep US RMM for patch, inventory, and monitoring while adding a governance layer for:

• Signed script enforcement before run
• Exportable security audit separate from RMM operational logs
• Agentic execution-intent gating (POST /api/Governance/execution-intent) with attestation

Document stack roles in customer DPIAs: which vendor holds privileged automation evidence vs patch compliance.

What may leave the primary EU region

Subprocessors (email delivery, support tooling, optional analytics) may process metadata in other regions. Request the subprocessor list at /trust/subprocessors during Govern early access. Enterprise DPAs document transfer mechanisms (SCCs, supplementary measures) where applicable.

Evaluation checklist for EU sovereignty buyers

1. Request written confirmation of home region (EU vs AU) for tenant database and backups
2. Map subprocessor countries and purposes; separate marketing from production
3. Identify script content classification per customer rules
4. Document audit export storage when copied to US GRC tools
5. Pair residency with isolation architecture (schema-per-tenant) and JWT tenant binding
6. Attach EU vendor pack to DPIA and ICT registers (GDPR, DORA, NIS2 as applicable)
7. Run one-session pilot: one agent, one signed script, one audit export

Contractual beats marketing

Marketing pages orient buyers; DPA, subprocessor appendix, and hosting matrix in contract define enforceable commitments. MSPs reselling services must flow down residency accurately to end-customers.

Honest limitations

We do not claim Gaia-X certification, EU cybersecurity certification schemes, or sovereign cloud badges. WORM audit immutability and native SIEM connectors remain backlog. Open-source mandates in some public-sector tenders may require self-hosted Enterprise discussions-not SaaS-only answers.

Trust hub cross-reference

See /govern/compliance/eu for GDPR, DORA, and NIS2 framework pages. Vendor origin and EU commercial contact appear on /trust and /trust/subprocessors. Contact security@trustholm.com for EU contracting entity details during procurement.

Appendix: evidence reproduction steps

Assign a reviewer to open Govern early access tenant, confirm API hostname region, export audit JSON, and capture IAM screenshots with timestamps. Store in immutable GRC folder. Compare quarterly. When subprocessors or Shipped/Gap rows change, re-run within ten business days. Pair technical evidence with customer governance documents. Never substitute marketing copy for reproduced checks in front of assessors.