Belgium’s Federal Public Service Mobility and Transport is responsible for preparing, implementing, and supporting mobility and transport policy across road, rail, water, and air, in close cooperation with regional, federal, and international partners. As a federal reference point for mobility expertise, it provides advice, information, and public services while balancing economic development, safety, environmental considerations, and the public interest.

Protecting sensitive data

FPS Mobility and Transport manages data, across multiple cloud platforms, including Microsoft Azure and Microsoft 365. While this cloud setup offers flexibility, it also raises a key challenge: how to safeguard sensitive government data under federal control at all times. Given the sensitive nature of mobility data, ensuring sovereignty is central to this challenge. To address this, Inetum and strategic partner Microsoft proposed a solution centered on Azure Managed HSM, a cloud-based service that allows organizations to generate and manage their own encryption keys.

At the heart of the solution are so-called Customer Managed Keys. Instead of relying on keys controlled by a cloud provider, FPS Mobility and Transport now creates, manages, and controls its own encryption keys. These keys are used to encrypt and decrypt data across Azure, Microsoft 365, and other Microsoft SaaS environments. As a result, access to critical data cannot be imposed outside the legal and operational framework of the Belgian federal government, strengthening both security and autonomy, and reinforcing data sovereignty and compliance with local regulations.

Moreover, FPS Mobility developed this setup as a blueprint that can be shared with other federal services operating in similar cloud environments. This strategic approach aims to accelerate the adoption of sovereign cloud practices across the Belgian government, allowing other departments to build on the technical foundations established in this project.

“For us, it was essential to adopt a solution that goes beyond technical security and truly safeguards our sovereignty,” says Stijn Fouquaert, ICT Infrastructure manager at FPS Mobility and Transport. “European governments and organizations need digital services that leave no ambiguity about who controls the data, the keys, and access rights. This approach proves that federal services can make use of the public cloud while retaining access to control over sensitive data.”

Evolve with regulation and technology

To ensure the solution can evolve over time, Inetum and FPS Mobility and Transport are combining architectural choices with governance measures, contractual safeguards, and a clear exit strategy. The federal service will also implement a recurring security and legal review cycle, allowing controls to stay aligned with new Belgian and EU regulations, changing threat landscapes, and jurisdictional considerations such as the US Cloud Act.

“From the outset, this project was designed to go beyond a single implementation and serve as a sovereignity-by-design blueprint for other federal services,” concludes Thomas Breuer, General Manager of Inetum Belgium. “Inetum took responsibility for the full governance and implementation layer, from access models and auditability to practical key management and secure integration into downstream services. Together with FPS Mobility and Transport, we have developed a blueprint that shows how public cloud technologies can be used while preserving European sovereignty and legal certainty. It is a model that can scale to other federal services and critical sectors, while strengthening citizens’ trust in digital public services and supporting a sovereign approach to digital transformation.”