The functional demo had gone well, the contract managers were enthusiastic, and then came the security review. IT asked one question: which jurisdiction does this supplier fall under? Nobody had the answer. Half a tender process later, the platform was ruled out after all. Not on functionality, but on the question of where the contract data sits and who can legally access it.
With European contract management software, the choice increasingly comes down to data sovereignty. Since the Dutch Cybersecurity Act took effect on 15 August 2026, the question of where your contract data sits has definitively shifted from an IT detail to a tender criterion. Local or international, and what does that difference mean in practice for your data?
Why the question “local or international?” suddenly matters
Until recently, software choices were about features. Could the platform monitor KPIs, calculate indexations, follow up on actions? That still matters, but it is no longer the first hurdle. In the public sector, healthcare and education, the security review increasingly decides whether a supplier is even eligible.
A schedule of requirements now states literally where the data may sit, which certifications are mandatory and who has access. A municipality drawing up a tender for contract management software must include data residency and GDPR safeguards as requirements. A university that requires ISO 27001 for every new application sees straight through a slick demo the moment the jurisdiction is unclear. The choice is not blocked on what the software can do, but on where your data ends up.
Data residency is not the same as data sovereignty
This is the heart of the matter, and exactly where many suppliers stay vague. Data residency tells you where your data physically sits: in which data centre, in which country. Data sovereignty goes a step further: which law governs the party that manages that data.
An example. A supplier places your contract data in a data centre in Frankfurt. “Our data sits in the EU” sounds reassuring. But if the parent company is American, that supplier falls under the US CLOUD Act. That law requires American companies to hand over data to their authorities, regardless of where the servers sit. Your data may sit in Europe, but outside the protection of European law alone.
That is the distinction a good IT gatekeeper makes. “Where does the data sit?” is the first question. “Which jurisdiction governs the party that can access it?” settles the matter. An EU data centre alone does not provide sovereignty. It comes down to the combination of physical location and legal control.
What this means for the public sector, healthcare and education
For a commercial company without sensitive data, an international solution is often perfectly fine. For the public sector, healthcare and education, it is a different story. These sectors manage sensitive information and answer to regulators, an internal compliance department or the local council.
Take a contract manager in a healthcare organisation with 12 sites and 40 outsourced contracts. They need to explain to the auditor why a supplier was chosen. Contracts contain supplier links to patient-related processes. If the inspectorate or the internal compliance department asks where that data sits and who can access it, “somewhere in the EU, I think” is not an acceptable answer. The accountability must be demonstrable, not an assumption. You can read more sector-specific requirements on the healthcare sector page.
Here a clear position is warranted. For these sectors, data sovereignty is not a luxury you arrange later, but a requirement you set out at the very start of the process. A supplier that only fails at the security review costs you weeks and sometimes an entire tender year. Use the jurisdiction question as your first filter, before the functional demo.
Your contract management software is itself a supplier in your chain
There is a blind spot in many selection processes. You buy European contract management software to manage supplier risks, but that software is itself a supplier in your chain. The party that processes your contract data is a link you must be able to account for.
Since 15 August 2026 the Dutch Cybersecurity Act has been in force, the Dutch implementation of NIS2, with no general transition period. Around 8,000 to 10,000 organisations are directly obliged. Higher education is the only exception, with three years to comply. The law requires you to demonstrably manage cyber risks from your supplier chain: knowing which suppliers there are, which requirements are in the contracts and which agreements remain open.
An important, honest framing: GRIP is not a cybersecurity or compliance tool and makes no one “NIS2-compliant”. What GRIP does do is give you grip on the contract side of that duty of care. And the software you use to do so should itself meet the same requirements you set for your other suppliers.
The questions you should ask every supplier
A short checklist that catches a security review early in the process rather than late.
- Where does the data physically sit, in which country and which data centre?
- Which jurisdiction governs the supplier and the parent company?
- Which certifications are in place, with certificate number and scope? ISO 27001 for information security, ISO 9001 for quality management.
- Who has access to the data, and how is that access arranged and logged?
- Which sub-processors are used, and which law governs them?
- Is there a data processing agreement based on the GDPR?
The question about sub-processors is often forgotten. A supplier may itself be European but use an American AI service or hosting provider. Keep asking until you know the whole chain. If you want to link those requirements to your own outsourced contracts, you do so in the Contract Dashboard.
GDPR-by-design and ISO 27001: what it means in practice
Certifications are not logos at the bottom of a website. They say something about how the software is built. GDPR-by-design means privacy is part of the design: data minimisation, purpose limitation and access control are built in from the ground up, not bolted on later.
ISO 27001 is a certification for information security. An external party assesses how access, encryption and incident management are arranged. At GRIP, the contract data is processed exclusively on European platforms, within the European Economic Area and under European law. That places the data outside the reach of the CLOUD Act. The AI sub-processor is Mistral AI, a French company under European law with a data processing agreement based on the GDPR. That is the difference between claiming residency and demonstrating sovereignty.
Frequently asked questions
What is the difference between data residency and data sovereignty?
Data residency tells you where your data physically sits. Data sovereignty is about which law governs the party that manages the data. Data in an EU data centre owned by an American company still falls under US jurisdiction via the CLOUD Act. Residency alone therefore does not provide sovereignty.
Why is the CLOUD Act relevant for European organisations?
The CLOUD Act requires American companies to hand over data to US authorities, regardless of where the servers sit. If you work with a supplier governed by US law, your contract data can in theory be requested, even if it sits in Europe.
Is an international contract management solution always a problem?
No. For organisations without sensitive data or an accountability obligation, an international solution can be a perfect fit. What matters is that you know what you are choosing and can account for it. For the public sector, healthcare and education, data sovereignty is often a hard requirement.
What does NIS2 mean for my choice of contract management software?
The Dutch Cybersecurity Act requires you to demonstrably manage cyber risks in your supplier chain. Your contract management software is itself a supplier in that chain. The software must therefore meet the same requirements you set for your other suppliers.
Does GRIP make my organisation NIS2-compliant?
No. GRIP is not a cybersecurity or compliance tool and makes no one NIS2-compliant. GRIP gives you grip on the contract side of the duty of care: which security and continuity requirements are in your outsourced contracts and which agreements remain open.
Which certifications does GRIP hold?
GRIP is ISO 27001 certified for information security and ISO 9001 for quality management. The contract data is processed exclusively within the European Economic Area, under European law.
Grip on your contract data and on where it sits
GRIP is European contract management software with data residency within the EU, ISO 27001, ISO 9001 and GDPR-by-design. Not a marketing tick box, but a concrete answer to the tender question your IT department is going to ask anyway. Explore the Contract Dashboard and book a demo.