valantic and Siemens: Building a sovereign data platform on AWS

Siemens wanted to automate governance as asset data flowed through the organization to support field service, predictive maintenance, and digital-twin initiatives. The global manufacturer must adhere to regional and federal data privacy legislation, including the European Union's General Data Protection Regulation (GDPR) and the German Federal Data Protection Act. In addition, data is subject to the company’s internal security framework, which classifies systems into tiers according to data sensitivity. Before this project, data sat in silos, with no central integration layer or automated data-residency enforcement. Each account had its own audit trail, so proving adherence to regulatory requirements required weeks of manual evidence gathering.

Service teams pulled information from multiple sources manually using legacy point-to-point integrations. Each new service offering required months of custom integration work with manual deployment processes, slowing time to market and hindering innovation. Siemens was also maintaining secondary disaster recovery (DR) data centers that weren’t used widely. In effect, those were expensive insurance policies that couldn’t deliver the recovery speed that modern operations needed. Without a consolidated, NRT data platform that enforced sovereignty structurally, Siemens couldn’t move forward on its digital-twin initiatives, which require NRT data synthesis across multiple sources. These limitations meant that Siemens couldn’t deliver the AI-driven predictive-maintenance services that its customers increasingly expected.

valantic undertook several initiatives to improve the digital sovereignty posture of Siemens’s data platform, providing technical expertise and a deep understanding of European data sovereignty requirements. Instead of migrating the existing systems to the cloud, valantic and Siemens designed a centralized integration platform as the foundation for Siemens’s next decade of digital services. The team built the platform around four pillars to enforce sovereignty by embedding compliance and security controls at every layer. The first pillar is data-residency enforcement at the infrastructure level. The second is customer-controlled encryption with hardware-backed key storage. The third is automated compliance monitoring and evidence collection. The fourth is interoperability through alignment to standards-based protocols, storage formats, data formats, and open specifications. By implementing automated guardrails, the manufacturer can keep data processing within dedicated German data centers.

Using Amazon Virtual Private Cloud (Amazon VPC), Siemens defines and launches AWS resources in a logically isolated virtual network. In every account, the team deployed Amazon VPC gateway endpoints for Amazon Simple Storage Service (Amazon S3), an object storage service, to encrypt Amazon S3 traffic. Workloads on Amazon Elastic Kubernetes Service (Amazon EKS), a service for building, running, and scaling production-ready Kubernetes applications, run in Amazon VPC subnets. Using AWS Network Firewall, Siemens deploys advanced network firewall security across its VPCs. To govern its multi-account AWS environment, the company adopted AWS Control Tower, along with service control policies for blocking changes that conflict with sovereignty requirements. Siemens gains visibility into account security and compliance posture by using AWS Config to assess, audit, and evaluate configurations of resources and AWS Security Hub to prioritize critical security issues. This framework transformed sovereignty controls from manual processes into enforceable, automated policies.

To encrypt highest-sensitivity data, the company relies on AWS Key Management Service (AWS KMS) to create and control keys. Through an AWS KMS External Key Store proxy that’s backed by hardware security modules, sensitive key material that’s used for encryption remains within Siemens-managed infrastructure. To automate compliance monitoring, the company uses systems that detect and remediate potential gaps proactively. The team designed the platform to meet Siemens’s second-highest internal security tier from day one, something that would have been nearly impossible to achieve with legacy infrastructure. And critically, valantic implemented GitOps automation that gave Siemens full deployment traceability while reducing release cycles from weeks to hours.

Now in production, the platform consolidated more than 50 source applications and 17 data formats into a unified model that could serve over 25 consumer applications. The platform now handles 2,000 requests per minute—four times Siemens’s target—and returns search results across more than 6 billion datasets in 3–4 seconds. Deployment speed also improved from weeks to hours, helping Siemens rapidly respond to customer needs and market opportunities. Through automated governance, the company reduced operational overhead by more than 40 percent, freeing technical teams to focus on innovation. The platform enforces sovereignty structurally. AWS Config findings—indicating misconfigured infrastructure that doesn't follow compliance rules—decreased by more than 75 percent. Mean time to detection (MTTD) averaged less than 20 minutes over 90 days, while mean time to remediation (MTTR) for critical and high-priority findings averaged 2 hours over the same period. “Over 60 automated controls were applied to preserve data residency and enforce operator access restrictions on customer data,” says Christoph Steinbach, senior solutions architect at valantic.

The global manufacturer can now pursue opportunities in highly regulated sectors with confidence. “Working alongside valantic, Siemens achieved full control over data residency, encryption, and compliance without compromising performance or innovation,” says Christian Schulze, project manager at Siemens. In addition to operational improvements, the platform created the NRT data foundation that the company needed for its digital-twin strategy and AI-driven predictive-maintenance services. Siemens removed its secondary DR infrastructure while achieving recovery times of 15 minutes or less and recovery point objectives of 5 minutes or less. As industrial markets continue to evolve, the company has positioned itself to meet customers’ requirements with enhanced infrastructure, compliance posture, sovereignty, and operational agility.