Digital Sovereignty
Data Sovereignty in Identity Management
Full control over your identity data, with a focus on security and compliance
Identity data is among your company’s most sensitive information. With the FirstWare IDM-Portal, you decide where your data is stored and who can access it: in your own data center, on the sovereign STACKIT Cloud, in European cloud environments, or in a hybrid setup. This allows you to tailor your identity governance to meet your requirements under the GDPR and the NIS2 Directive.
Made in Germany
GDPR & NIS2 compliant
25 Years of IAM Expertise
Vendor- & Cloud-independent
Reality Check:
When identity data gets out of control
In many organizations, the question “Where is our identity data stored, and who has access to it?” cannot be answered right away. The more cloud services are added, the more systems, locations, and jurisdictions are involved. The choice of hosting is often dictated by the provider rather than the customer.
The legal jurisdiction often remains unclear
Providers based outside the EU may be subject to regulations such as the U.S. CLOUD Act, even if their servers are located in Europe. For organizations with high standards for data sovereignty, this is an issue that should be carefully evaluated.
Dependence on the provider
If the provider determines where data is stored and how it is processed, switching providers later or separating cloud and on-premises data becomes a complex undertaking.
Management responsibility under NIS2 & GDPR
NIS2 and data protection laws place obligations on executive management and IT decision-makers. Anyone who needs to demonstrate where identity data is stored and who can access it requires a robust foundation for doing so.
Blind spots in hybrid infrastructures
Organizations often do not know exactly which identity and attribute data from the local Active Directory is synchronized unfiltered into global cloud directories.
Your data sovereignty with IDM-Portal
Full data sovereignty & data residency
You decide where your identity data is stored
The FirstWare IDM-Portal lets you choose where your personnel and authorization data is stored and processed: in your own data center, on the sovereign German STACKIT Cloud, or with other cloud providers such as Microsoft - in each case, with data stored in European data centers.
Hybrid scenarios are also possible. You can connect your local infrastructure to the cloud while retaining control over which data is processed where.
This allows you to choose the data residency that best fits your security needs and regulatory requirements, whether those stem from the GDPR, the NIS2 Directive, or your status as a critical infrastructure operator.
Jurisdiction of your choice
You decide which law applies to your data
Not every organization has the same requirements. Organizations that process particularly sensitive data - such as those in the public sector or critical infrastructure companies - often choose an infrastructure that is governed exclusively by European law and whose operators are not subject to the jurisdiction of non-European laws. The sovereign German STACKIT Cloud is an ideal solution for this.
Other organizations deliberately opt for the Microsoft Cloud with data stored in European data centers - for example, because they already work in a Microsoft environment and want to continue using their existing licenses, processes, and integrations.
The FirstWare IDM-Portal supports both approaches. Which option is right for you depends on your protection needs, regulatory requirements, and your existing IT landscape. We’ll advise you and guide you through the decision-making process.
Granular data synchronization
Only what belongs in the cloud goes there
Not every attribute belongs in a cloud directory. With the IDM-Portal, you can specify which identity data - such as emergency contacts, internal extensions, or security-related attributes - remains on-premises and which is synchronized with services like Microsoft Entra ID.
This allows you to consistently apply the principle of data minimization, reduce your attack surface, and maintain an overview of what leaves your system boundaries.
The sovereign option: STACKIT Cloud
Data centers in Germany, certified to BSI C5
As a partner of STACKIT, the Schwarz Group’s European cloud, we also offer the FirstWare IDM-Portal on sovereign infrastructure with data centers in Germany. For organizations that want to process their identity data exclusively in data centers in Germany and under European data protection law, this is a strong option.
The STACKIT Cloud is certified according to the BSI’s C5 criteria catalog. Over 120 criteria across 17 security areas are assessed, not only in terms of design but also in terms of ongoing effectiveness. For public institutions and KRITIS companies, this provides a robust basis for compliance.
What is FirstWare IDM-Portal?
Flexible IAM solution for Identity Governance & Administration
FirstWare IDM-Portal is a user-friendly IAM solution for automated provisioning and lifecycle management of all identities and groups in complex, hybrid IT landscapes.
Powered by my-IAM – the underlying technology platform that enables seamless connection of any IT systems and cloud services.
Sovereign control across your entire IT landscape
Whether cloud-native, hybrid or on-premises, data sovereignty must not end at system boundaries. FirstWare IDM-Portal connects your systems seamlessly and sovereignly:
HR source systems
Personio, SAP SuccessFactors, SD Worx, Loga3
Directory Providers
Active Directory, Microsoft Entra ID, Keycloak, OpenLDAP
Specialist software & APIs
Connection of industry-specific software, SQL databases and specialist systems while strictly preserving your data sovereignty.
No matter how individually your system landscape has grown, you gain one consistent view of all identities, regardless of where the data originally comes from.
Your Benefits
Made in Germany, hosting in DE and EU
Support for NIS2 & GDPR requirements
Free choice of data storage location
Granular control over your data
Protection against third party access
Access to the sovereign STACKIT Cloud
Frequently Asked Questions
Frequently asked questions about data sovereignty, transparent data control, secure access processes and self-determined handling of identity data in FirstWare IDM-Portal.
What does data sovereignty mean in the context of IAM?
Data sovereignty means that an organization has complete legal, technical and organizational control over its identity and access data. This includes knowing and determining where data is stored, who can access it and under which laws it is processed.
Why is the U.S. CLOUD Act relevant to European IAM data?
The U.S. CLOUD Act allows U.S. authorities to require U.S. providers to hand over stored data pursuant to a lawful order, even if the servers are located in Europe.
In the case of identity data containing personal information and trade secrets, this can lead to a conflict with the GDPR. Those who require maximum legal certainty should consider hosting options with a purely European operating company.
How does the FirstWare IDM-Portal support data sovereignty?
As a German company, FirstAttribute AG is subject exclusively to European and German law.
The architecture of the IDM-Portal and the underlying my-IAM platform allows for operation in your own data center or in European-hosted sovereign clouds such as STACKIT. This way, you retain control over your data.
Where can the IDM-Portal be hosted?
You have the choice: in your own data center, on the sovereign STACKIT Cloud (data centers in Germany and Austria), or with other cloud providers such as the Microsoft Cloud.
Hybrid scenarios are also possible.
Which option is right for you depends on your security requirements, regulatory requirements, and your existing IT landscape. We’d be happy to advise you.
Can I use FirstWare IDM-Portal if we already use Microsoft Entra ID?
Yes, absolutely. IDM-Portal integrates seamlessly with Microsoft Entra ID and hybrid environments. It acts as a sovereign governance layer that lets you precisely filter and control which attributes from your local systems are synchronized with the cloud.
How does the IDM-Portal help companies implement NIS2 requirements?
NIS2 requires affected companies to have effective risk management, controlled access, and verifiable processes.
The FirstWare IDM-Portal supports you in this effort with traceable audit trails for permission changes, role and recertification processes, and the option to host identity data in your own data center or in a European cloud. This makes it easier for you to provide evidence to auditors and regulatory authorities.
Let's Talk
Maintain full control over your identity data
We'll work with you to determine which hosting model and governance structure best meet your security needs and requirements.
Call us at 0 8196 - 998 4330 or use our contact form.