How a Polish defence contractor cleared its NATO supply-chain audit on EU-sovereign bare metal

The trigger: a compliance hold on a contract worth years of revenue

The call came from the contractor’s government customer, not from an internal audit team. A formal review of the supply chain’s data-handling practices had flagged that telemetry feeds and engineering design files for active NATO-adjacent programmes were transiting US-jurisdiction infrastructure. The contract renewal, worth several years of revenue, was placed on hold pending remediation. The Polish defence contractor had roughly one quarter to resolve it.

The organisation supplied precision equipment to several NATO member governments. Its engineering collaboration platforms, CAD repositories, and project telemetry all ran on a major hyperscaler. None of that infrastructure sat in Europe in any legally meaningful sense: the provider’s terms of service preserved the right to transfer data to US-based systems, and the parent company answered to US law, including statutes that permit government access to data held by American firms regardless of where the servers physically stand.

Polish national security regulations treat defence-related technical data as a protected category. Routing it through a jurisdiction where a foreign government could compel disclosure without recourse to Polish courts is not a grey area: it is a breach. The NATO supply-chain compliance framework the contractor’s customer applied layered additional requirements on top, demanding documented evidence that sensitive project data remained within sovereign, auditable infrastructure throughout its lifecycle.

The technical challenge: sovereignty is not just geography

Moving workloads to a European data centre run by a US-headquartered provider would not have resolved the problem. The audit criteria were explicit: the infrastructure operator had to be incorporated and governed under EU law, with no foreign parent company capable of receiving a compelled disclosure order. The contractor needed what the framework called a sovereign cloud provider, and the definition was narrow.

The engineering environment added complexity. The collaboration platform in use was a self-hosted instance of a widely deployed tool, running alongside a document management system that versioned and archived CAD assemblies, bill-of-materials files, and test telemetry. These workloads required consistent, low-latency block storage, predictable CPU performance for rendering and simulation jobs, and physical isolation from shared tenants. A virtualised cloud environment with noisy-neighbour risk was not acceptable for the simulation workloads; the client needed bare metal.

Sovereignty on paper is not sovereignty in practice. The audit team wanted to see the legal chain of custody, the physical location of every storage volume, and the contractual terms under which the operator could or could not be compelled to disclose. Generic hyperscaler attestations did not satisfy any of those three criteria.

Network architecture posed a further constraint. The contractor’s sites in Poland needed to reach the infrastructure with latency low enough to keep the collaboration platform responsive for engineers working on live assemblies. Routing through distant peering points would have degraded the user experience to the point of operational disruption.

What DIVERSITY built and how

DIVERSITY deployed dedicated bare-metal servers at its MUC1 Munich facility, selected for its geographic proximity to Poland, its dense connectivity into Central European carrier infrastructure, and its position within the DACH finance and industry cluster that already operated under stringent data-handling regimes. The servers were provisioned under a contractual framework that explicitly committed to EU-only data residency, with no cross-border transfer clauses, and governed entirely under European law with no foreign parent entity in the ownership chain.

The migration was structured in three stages. First, the document management system and its versioned archive were moved, because that repository held the highest-classification material and satisfying the audit required demonstrating its location first. Block storage volumes were provisioned on dedicated hardware, encrypted at rest with keys held exclusively by the contractor, and replicated to a secondary volume within the same facility for resilience. Second, the engineering collaboration platform was re-deployed on bare metal, with the database tier separated onto its own dedicated host to eliminate contention during peak rendering jobs. Third, the telemetry pipeline, which ingested sensor data from test rigs, was redirected to object storage on the DIVERSITY platform, replacing the hyperscaler bucket that had been the original compliance trigger.

Network connectivity was addressed through DIVERSITY’s carrier-neutral infrastructure at MUC1. The contractor’s Polish sites connected via a dedicated private circuit arranged through DIVERSITY’s telecom capability, bypassing public internet routing entirely for the most sensitive data flows. Latency from the primary engineering site in Poland to the Munich infrastructure settled at figures that made the collaboration platform indistinguishable in feel from a locally hosted system.

The audit documentation package was assembled in parallel with the technical migration. DIVERSITY provided the contractual evidence, data-processing agreements, and infrastructure attestations the government customer’s audit team required: legal incorporation records, confirmation of EU-only data residency, the absence of any foreign parent with compelled-disclosure exposure, and ISO 27001 certification covering the Munich facility. The contractor’s own security team conducted a penetration test against the new environment before the audit submission, using DIVERSITY’s SecOps penetration testing capability, and the results were included in the remediation dossier.

The outcome: audit cleared, contract renewed, risk removed

The formal audit was completed within the quarter. The government customer’s review team accepted the remediation package without requesting further evidence, and the contract renewal was confirmed shortly after. The revenue that had been placed on hold was secured, and the contractor retained its position as a qualified supplier to multiple NATO member governments.

Beyond the immediate contract, the migration resolved a structural exposure that would have recurred at every subsequent renewal. The contractor’s legal and compliance team no longer needs to produce exceptions or explanations for why defence-related technical data sits on foreign-jurisdiction infrastructure: it does not. The engineering environment runs on bare metal that is contractually, legally, and physically within the EU sovereign perimeter the NATO supply-chain compliance framework requires.

The performance outcome was also measurable. Simulation jobs that had competed for resources on shared virtualised infrastructure now ran on dedicated hosts, and the engineering team reported a reduction in job queue times that made a material difference to iteration cycles during the test phase of a new programme. Sovereignty and performance, in this case, were not in tension.

For organisations in the defence sector facing similar audit pressure, the relevant question is not whether to move but how quickly the move can be documented to the required standard. The technical migration is tractable; the compliance packaging around it is where engagements succeed or stall. DIVERSITY’s experience across defence, finance, and healthcare customers means both parts of that problem are familiar territory.