AI for classified data: secunet's sovereign cloud is not ready yet
secunet, Red Hat and deepset plan German-hosted AI for classified workloads. Why existing security approvals do not yet cover the new agent runtime.
secunet, Red Hat and deepset are developing a Germany-hosted AI cloud for classified-data use cases, combining SINA security architecture, Red Hat AI Factory and Haystack agent orchestration. Integration, validation and further approvals remain ahead; the proposed AI runtime is not yet a generally deployable classified service.
CLAIM-LEVEL EVIDENCE
Evidence and remaining unknowns
- Primary source:
secunet – October 26 primary statement
The partners propose a German-hosted AI runtime and cite existing SINA security-component approvals.
- Evidence limit:
Unverified scope
The integrated AI offering has not completed the announced validation and authorization steps.
The integrated AI offering has not completed the announced validation and authorization steps.
The important detail is in the release's last paragraph
Putting a language model near classified information is not primarily a model-selection exercise. Hosting location, key management, authorized data flows and system-specific approvals determine whether the workload can operate at all. Germany's secunet wants to address that constraint with Red Hat and deepset. The partners set out the plan around NVIDIA GTC Berlin in an announcement dated October 26.
The strongest editorial distinction is between a proposed service and a service that agencies may already deploy. secunet says the components still have to be integrated, validated against the intended scenarios and taken through the required approval processes. This is a meaningful infrastructure project, but not evidence that a complete AI service is already cleared for every classified workload.
The proposed stack, layer by layer
secunet intends to operate the offering in its German data centers, drawing on its existing SINA Cloud security architecture. Red Hat contributes AI Factory infrastructure for containerized model operations, with NVIDIA technologies and models in the stack. deepset contributes Haystack, the open framework intended to connect retrieval, enterprise knowledge and agent workflows. The partners also cite NVIDIA BlueField-3 DPUs for hardware-isolated security functions.
Each layer addresses a distinct problem. The model processes input; the orchestrator decides which tools and context to use; the runtime separates workloads; and the security architecture defines which data is permitted to cross a boundary. The proposed combination makes technical sense. Its effectiveness, however, will be judged at the interfaces between those components, where secrets, temporary files and tool permissions can escape a neat reference diagram.
Existing BSI authorizations are not an approval for the new AI runtime
secunet's existing SINA Cloud security components have documented authorization for specific classified-information use cases. That is important evidence for the foundation. It is not a transferable certificate for the uncompleted combination of AI models, GPU hardware, agent tools and application logic. The current announcement itself makes clear that further integration, validation and formal approvals are pending.
Procurement teams should therefore distinguish the inherited assurance of individual components from the future assurance of the deployed system. They will need answers about logs, caches, identities, network egress and approval boundaries for the exact data classification. A platform can be credible on paper and still fail the requirements of a particular operating environment.
Our view: sovereignty is a measurable operating property
We see a credible strategic need for the project. Secure domestic hosting, open interfaces and a capable agent framework could give European public-sector organizations a path to experimentation that ordinary cloud services do not offer. The proposed architecture addresses genuine operational barriers rather than adding another chatbot skin.
Still, the word 'sovereign' does no security work on its own. Can an organization swap models without rebuilding its workflows? Can it block all unapproved outbound calls? Are credentials isolated from the model's decisions? Is every retrieval and tool call reviewable? Does the operator have a workable exit path? Those are the questions that turn a national hosting claim into usable operational independence.
What a serious pilot should demand
Before any sensitive pilot, we would want a system-specific security boundary, the intended information classification, documented data residence for logs and intermediate artifacts, credential lifecycles, release-management controls and the precise scope of each authorization. Agentic workflows also need adversarial tests: a malicious document should not gain permission to call an unapproved tool.
AgentenCode's Trust evidence framework and AI-agent security guide describe the questions behind such reviews. Our agent directory also distinguishes model features from the tools and runtimes around them. We do not currently claim an independently validated dossier for this future secunet service; its remaining approval gap is part of the story, not a detail to hide.
Primary sources and AgentenCode evidence
Our assessment draws on the cited primary documents and their limits; it is not an independent product field test.
Frequently asked questions
Is the new secunet AI runtime approved for classified use now?
No. The complete proposed runtime still needs integration, validation and the necessary approvals.
Does SINA Cloud certification automatically extend to the AI stack?
No. Existing approvals for particular components cannot automatically certify future models, applications and workflows.
What is deepset contributing?
deepset brings Haystack for retrieval, enterprise knowledge connections and agent orchestration.