Sovereign Cloud
for BlackBerry UEM
Access, location, protection
Modern endpoint management must meet increasing requirements for sovereignty, security and compliance. The ISEC7 Sovereign Cloud for BlackBerry® UEM is designed to give organizations full control over their digital workplace – without external dependencies.
Sovereignty
No manufacturer or third-party access to your systems.
Data ownership and administrative control stay with your organization; ISEC7 runs the operations.
Data Control
Hosting and operations exclusively in Germany support compliance with GDPR, national regulations and sector-specific requirements – under German jurisdiction only.
Protection
Hardened architectures, regular updates and proven security controls protect your endpoints, applications and data throughout their entire lifecycle.
Enterprise or Regulated: which package fits?
The ISEC7 Sovereign Cloud for BlackBerry® Unified Endpoint Management is available in two clearly defined packages. Both variants provide full data sovereignty and German hosting and operation, and are designed for strict regulatory requirements. The Regulated package extends the Enterprise variant with controls and processes for government and for environments with indigo devices and Samsung Knox Native.
Enterprise Sovereign Cloud
For enterprise customers and public sector organizations
The Enterprise Sovereign Cloud is designed for organizations and public sector organisations that require secure and compliant endpoint management without sacrificing flexibility. It provides a sovereign cloud environment for BlackBerry UEM operated exclusively in Germany.
- German-hosted and German-operated sovereign cloud infrastructure
- Full data sovereignty and data ownership
- No manufacturer or third-party access to systems or data
- Designed for GDPR, NIS2 and sector-specific requirements
- Transparent operations and audit-ready architecture
Typical use cases:
Regulated enterprises, KRITIS operators, secure mobile and hybrid workplaces.
Request Enterprise Consultation
Regulated Sovereign Cloud
For regulated public sector and government security environments
The Regulated Sovereign Cloud for indigo and KNOX Native is designed for organizations with the highest security and compliance requirements. It builds on the Enterprise package and adds controls and processes required for sensitive and governmental environments.
- Designed for indigo and Samsung Knox Native
- Operation in certified German data centers
- German jurisdiction, operated by ISEC7 GmbH staff in Germany
- Extended documentation, audits and compliance controls
- Suitable for sensitive public sector environments
Typical use cases:
Authorities, public sector organizations, defense, law enforcement and sensitive workloads.
Request an indigo briefing
Certifications and evidence, and who holds them
The ISEC7 Sovereign Cloud for BlackBerry® Unified Endpoint Management is designed for the regulatory, security and compliance requirements of enterprises, critical infrastructure operators and public sector organizations.
ISEC7 Group certifications
- ISO 27001:2022 and ISO 9001:2015 for ISEC7 Group AG, ISEC7 GmbH, ISEC7 Software GmbH and ISEC7 Inc., valid until 2 September 2027
Regulatory Compliance and Data Protection
- GDPR-compliant data processing
- German jurisdiction and data residency
- Operated by ISEC7 Group in Germany, with no manufacturer access to systems or data
- Clear data ownership and full auditability
Public Sector and Government Environments (indigo)
- The platform, BlackBerry UEM, holds Common Criteria certificate BSI-DSZ-CC-1235-2025, issued on 8 September 2025 (BlackBerry UEM Server 12.21.1, EAL4+, valid until 7 September 2030). The certificate holder is BlackBerry Ltd.; ISEC7 is the operator.
- Suitable for sensitive and governmental workloads
- ISEC7 GmbH staff in Germany run the operations.
Certifications and standards:
Applicable certifications and compliance scope depend on the selected package and customer environment.
Sovereign Cloud and standard cloud compared
Not all cloud deployments offer the same level of control, transparency and compliance. The comparison below highlights the key differences between standard cloud deployments and the ISEC7 Sovereign Cloud for BlackBerry® UEM.
| Criteria | Standard Cloud | Enterprise Sovereign Cloud | Regulated Sovereign Cloud |
|---|---|---|---|
| Data residency | Multi-national | Germany only | Germany only |
| Operational responsibility | Manufacturer / hyperscaler | ISEC7 | ISEC7 |
| Manufacturer access | Possible | No | No |
| GDPR compliance | Limited | Yes | Yes |
| German jurisdiction | No | Yes | Yes |
| Suitable for public sector | Limited | Yes | Yes |
Frequently asked questions about the Sovereign Cloud for BlackBerry UEM
What is a sovereign cloud, and why would you need one?
A sovereign cloud usually means a cloud whose hosting, operations and data storage sit in a defined jurisdiction and where neither the manufacturer nor third parties can access systems or data. It is needed where organizations use cloud services but must decide themselves where data is stored and who can access it. The Sovereign Cloud for BlackBerry UEM is such an environment: ISEC7 hosts and operates BlackBerry UEM in Germany, with no manufacturer or third-party access.
How can I run a UEM without my data going to a US cloud?
Either in your own data center or in a cloud whose hosting and data storage are in Germany or the EU and whose operator controls access. In the Sovereign Cloud for BlackBerry UEM, BlackBerry UEM runs in an environment that ISEC7 hosts and operates in Germany, with data kept only in Germany. Neither the manufacturer nor third parties have access to systems or data, and data ownership and administrative control stay with your organization.
Does the US CLOUD Act apply to a cloud hosted in Germany?
There is no blanket answer: whether and how non-European law such as the CLOUD Act applies to a project is a question for your organization's legal review. The Sovereign Cloud for BlackBerry UEM is operated by ISEC7 Group in Germany, under German jurisdiction and with data residency in Germany; the manufacturer has no access. For that review, operations are transparent and the architecture is documented for audit.
Which BSI approvals exist for iPhones and Samsung devices up to VS-NfD, and who holds them?
The approvals belong to the manufacturers: for indigo, Apple holds BSI approvals BSI-VSA-10900 (up to VS-NfD) and BSI-VSA-11003 (NATO RESTRICTED) plus operating permission BSI-VSA-10901, all valid until 31 October 2027. For Knox Native Solution 3.13, Samsung has held operating permission BSI-VSA-11044 up to VS-NfD since 28 July 2026, valid until 31 August 2027. The Regulated package of the Sovereign Cloud for BlackBerry UEM is designed for both, and ISEC7 runs the UEM for them as an indigo integrator.
Who holds the BSI certification for BlackBerry UEM?
BlackBerry Ltd.: BlackBerry UEM Server 12.21.1 holds Common Criteria certificate BSI-DSZ-CC-1235-2025, issued on 8 September 2025 at EAL4+ and valid until 7 September 2030. In the Sovereign Cloud for BlackBerry UEM, ISEC7 is the operator, not the certificate holder. ISEC7 Group's own certifications are ISO 27001:2022 and ISO 9001:2015, valid until 2 September 2027.
How do Enterprise and Regulated differ?
Enterprise is the sovereign cloud for BlackBerry UEM with hosting, operations and data residency in Germany and an audit-ready architecture, aimed at regulated companies and KRITIS operators. Regulated builds on it and adds controls and processes for government, defense, law enforcement and sensitive workloads: operation in certified German data centers, extended documentation, audits and compliance controls. Regulated is the package for indigo and Samsung Knox Native.
Who runs the environment?
ISEC7 is responsible for operations, carried out by ISEC7 GmbH staff in Germany. That covers hardened architecture, regular updates and documentation. Administrative control and data ownership stay with you.
Can we move from BlackBerry UEM in our own data center to the Sovereign Cloud?
ISEC7 advises on, migrates and runs BlackBerry environments and handles UEM migrations, including between platforms. How the move works for your installation is something we work out in a consultation on the Enterprise or Regulated package.
Last reviewed: 28 September 2026 · BlackBerry UEM certificate as listed by the BSI · ISEC7 Group certificates as listed on isec7.com/en/about-us
Take Control of Your Sovereign Endpoint Infrastructure
Whether you operate in a regulated enterprise environment or need security at government level, the ISEC7 Sovereign Cloud for BlackBerry® Unified Endpoint Management provides the control, transparency and compliance your organization needs.
Speak with our experts to evaluate the right package for your requirements.