Cloud consulting in Berlin for firms that want data in Germany

Two starting points we meet often

The first is the server in the basement. A family-owned manufacturer runs its ERP, file shares and email archive on hardware bought eight years ago, maintained by one IT administrator and a local service partner. It works. It also means one failed controller, one flooded cellar or one ransomware attack away from a week without invoicing. The managing director knows this, but moving feels risky and nobody has had time to plan it.

The second is the Berlin start-up whose cloud credits have run out. The platform was built quickly on AWS or Google Cloud, with test environments nobody switched off, databases sized for a growth curve that has not arrived yet and no clear owner for the monthly bill. Now the CFO wants it halved without breaking anything.

Both need the same discipline: know what runs, decide where it should run, secure it, and make the cost visible. Good cloud consulting, Berlin scale-up or Mittelstand plant, starts with that inventory rather than a sales pitch for one provider. We work with all three major platforms and recommend the one that fits your systems, skills and contracts.

Cloud regions in Germany

Data location is usually the first question German clients ask, and the good news is that there are plenty of options. AWS, Microsoft Azure and Google Cloud all operate regions in Frankfurt, and Google opened a second German region in Berlin-Brandenburg in 2023. For most workloads that means data can stay in Germany, with backups in a second German or EU location.

Whether data must stay in Germany, or whether an EU region is fine, depends on your sector, your customer contracts and your own policy. Public sector and healthcare clients often write strict location clauses into tenders. Many B2B customers simply ask in their supplier questionnaires. We map those requirements first, then choose regions, and write the reasoning down.

The questions your auditors and DPO will ask

• Where exactly is personal data stored and processed, including backups and logs?
• Is there a data processing agreement with each provider, as Article 28 of the GDPR requires?
• What happens to data access requests from outside the EU, and which transfer safeguards apply?
• Do the services hold the C5 attestation, the cloud security criteria published by the German Federal Office for Information Security (BSI)?
• Who has administrator access, how is it logged and how often is it reviewed?
• Are backups tested, and how long does a full restore take?

What our cloud consulting covers

• Assessment: an inventory of what runs today, what it costs and where the risks are
• Architecture: a design on AWS, Azure or Google Cloud sized for your real load
• Migration: moving servers, databases and files with tested rollback and an agreed cutover window
• Security baseline: identity and access, encryption, network rules, logging and backups you have actually restored
• Cost review: idle resources, oversized machines, storage tiers and commitment discounts
• Managed operations: monitoring, patching and incident response after launch, with response times agreed in writing

Security duties are widening

The EU's NIS2 directive extends cybersecurity duties to many more mid-sized companies than the rules it replaced, including firms in manufacturing, logistics, food and digital services. Whether it applies to you depends on your size and sector, and your legal adviser should confirm that. Either way, the practical steps are the same ones a sensible cloud setup includes: know your systems, control access, log what happens, keep tested backups and have a written plan for incidents.

We build those into the design and hand over the documentation, so that when a customer, an insurer or an auditor asks, the answers already exist.

How the work runs

• Talk: 15 minutes on what you run and what worries you most about it.
• Plan: inventory, region decision, security baseline and cost estimate in a written roadmap within 5 to 7 days.
• Build: environment setup and migration in stages, each with a date in writing and a rollback ready.
• Grow: monthly cost and security reviews, and changes as you add sites, products or markets.

Planning changes around the Berlin calendar

Cloud work runs in the console and in code, so Berlin teams agree a change calendar with us at the start. Planned changes go into windows you choose, with an engineer watching and a rollback step written down. We plan cutovers away from month-end closing, peak order weeks and German public holidays.

When a migration involves physical hardware, such as switching off servers at your site, we either plan a visit or coordinate with your local IT service partner. We agree which one at the planning stage.

Proof that dates hold

We have broadcast more than 20 live events, where a missed deadline is visible to everyone watching. That habit carries into cloud work: cutover windows are fixed, rehearsed and kept. We have also delivered more than 30 AI builds that run on the cloud platforms we set up. We do not publish client names; examples are available on a call.

What moves the cost

The cloud consulting Berlin and German clients buy from us is priced after the assessment. The main factors are the number and size of workloads, migration versus new build, location and compliance requirements, the security level needed and whether you want managed operations afterwards. Your own cloud bill is a separate cost, and reducing it is part of the job.

Questions

Can our data stay in Germany?

In most cases, yes. AWS, Azure and Google Cloud all run regions in Frankfurt, and Google also runs one in Berlin-Brandenburg. We choose services available in those regions and confirm that backups and logs stay where your policy says.

Is a US cloud provider allowed under GDPR?

Many German companies use them lawfully, with EU regions, data processing agreements and recognised transfer safeguards in place. The details depend on your data and your risk view, so your data protection officer or legal adviser should confirm the position. We supply the technical documentation they need.

What is C5 and do we need it?

C5 is a catalogue of cloud security criteria published by the BSI, Germany's federal cyber security office. Major providers hold C5 attestations. Some customers and public bodies ask for it, so we check which services in your design are covered.

Can you reduce our cloud bill?

Often. Reviews usually find idle test environments, oversized databases, old snapshots and missed commitment discounts. We list each saving with its risk, make safe changes first and report results monthly. We do not promise a figure before seeing your account.

Do you offer cloud consulting in Berlin on site?

Almost all of the work is done in the console and in code, with review calls booked at times that suit your Berlin team. For hardware tasks or a planning workshop we can travel, or work with your local IT partner, and we agree which approach applies before the project starts.

How do you avoid downtime during migration?

We test the new environment with real data first, plan the cutover for a quiet window, rehearse it and keep a rollback ready. Most moves need a short pause rather than a long outage, and the timing is agreed in writing.

Book a 15-minute call.

A fit check, not a pitch. A few questions, an honest answer and a clear next step. Not every call ends in a proposal.

Book 15 minutes