The login screen is where sovereignty gets real

The login screen is where sovereignty gets real Everyone points at the cloud. Almost nobody points at the front door. Ask most executives where their sovereignty risk sits and they point at the cloud, the data, the AI models. Fair enough, those are big, but there is a smaller thing, sitting underneath all of it, that almost nobody names out loud: the login screen. Every morning your people sign in. Customers, partners, staff. That sign-in runs through an identity system. And whoever controls that system controls who gets in, and who stays out. It is the quietest dependency you have. It is also the most complete one. We know this at SUSE®, because we had it too. Why SUSE moved to SUSEID For years our own identity ran through a third-party SaaS provider. It worked, it was convenient and compliant. However our own control over it was limited. We spend our days telling customers to look hard at exactly this kind of dependency. At some point you have to turn that question on yourself. So we did. We moved our identity home, and we called it SUSEID. Why identity is the foundation of digital sovereignty Our point of view on sovereignty is short. Sovereignty is a trust problem. The real question under every framework and every regulation is this one: who controls access to your critical systems, and under what circumstances can that access be changed, restricted, or taken away? Read that again and tell me what it describes. It describes identity. Not the data. Not the workload. The thing that decides who can reach any of it in the first place. That is why identity is where the whole sovereignty conversation stops being abstract. A data residency debate can stay theoretical for years. An identity provider that can be compelled by a foreign court, or simply go down for an afternoon, is not theoretical at all. It is one instruction away from locking your people out. Why identity creates jurisdictional risk You saw a version of this in early 2025. A senior international official lost access to their email after sanctions landed on the institution they worked for. No hack, no breach, a provider followed the law of its home country and switched the account off. That is jurisdictional risk in a single image. Not a threat model on a slide. A real person, locked out of their own work, by a decision made somewhere else, under someone else’s law. Identity is where that kind of thing happens first, because identity is the switch. What we actually did Moving identity is hard, and I will not pretend otherwise. The login screen looks simple. Behind it, a SaaS provider is quietly running an entire operation on your behalf. You sign in, and somewhere someone else is keeping a database alive, storing files, rotating certificates, watching the whole thing, and patching it at two in the morning when something breaks – multiply that by a few million times a day and you get the full picture. When you leave the SaaS, that work does not disappear. It comes home with you. So SUSEID is not one tool. It is a stack. Authentik handles the identity and single sign-on. A directory service and an LDAP layer sit behind it for the systems that still speak that language. The accounts live in PostgreSQL, kept alive through failover by Patroni, because an identity system that goes down takes everything else down with it. Object storage, certificate management, monitoring, all of it there too. And a set of migration and HR-sync tools to move thousands of accounts across without breaking anyone’s Monday, but wait that is just the internal view. Think about the 2+ million accounts for our Partners and Customers! The whole stack runs on our own platform: SUSE Linux Enterprise at the base, SUSE Virtualization and SUSE Rancher Prime above it. Our infrastructure, our jurisdiction, our people. Say that plainly and you can hear the trade. The SaaS was live next week and someone else carried the weight. This we stood up ourselves, and we carry the weight now – from creation to run and operate the Tier-1 service everyone interacts with. That is the real cost of leaving, and most of it lands at the start, before the thing is running. Anyone who tells you sovereignty is free is selling you something. Here is why the trade is worth making. Convenience you rent can be taken away. An operation you run yourself cannot. Once the stack is standing, the keys to our front door sit on a foundation we can read, run, patch and audit, under our own law, operated by our own hands. The heavy part is the beginning. What you get for it is permanent. What this means for you I am not writing this to sell you an identity product. SUSEID is for our own ecosystem, not a line on a price list – because it is our DNA. I am writing it because the exercise is the point, and you can run it too. Look at your own foundations. Not the loud parts. The quiet ones. Authentication. Secrets. The registry your developers pull from. The plumbing you stopped questioning years ago because it “just works.” And remember what we just learned the hard way: a SaaS login hides a whole stack. When you weigh leaving, weigh the whole thing, not only the screen. Then ask the same three questions we asked ourselves: - Who controls it? - Under whose law does it operate? - If they changed the terms, or were forced to, how fast could you move, and what would you have to run yourself once you did? If those answers are uncomfortable, you have just found where to start. Most organisations only discover their exit is a document rather than a real capability on the day they finally try to use it. You should not have to build it from scratch This is where a platform earns its keep. You should not have to source a stack like this from a dozen random registries and hope the pieces fit together. SUSE Rancher Prime gives you the container management to build and run a whole system like SUSEID. SUSE Virtualization runs the machines under it. SUSE Linux Enterprise sits at the base. That is the ground the rest of it stands on. And you do not start from an empty catalogue. SUSE Application Collection already carries many of the building blocks a stack like this needs: the Prometheus operator for monitoring, PostgreSQL for the database, cert-manager for certificates, and more. Each one comes curated, with a bill of materials and provenance you can check, built with compliance and sovereignty in mind. You assemble the platform you need, from parts you can trust, instead of from the open internet. The point Sovereignty is control, not location. We say it often. Moving our own identity home is us living it, on the one layer we would have most liked to leave untouched, and it cost us real work to do it. So here is my question for you. When you imagine losing control of your business tomorrow, you probably imagine the cloud going wrong. But who, right now, can decide whether your people log in on Monday morning? And if you had to take that layer back, do you know everything you would be signing up to run? If you want to think this through for your own estate, our view on sovereignty as a trust problem is a good place to begin, and our sovereignty self-assessment will show you where your own quiet dependencies are hiding. SUSE is a global leader of enterprise open source software. By transforming community innovations into secure, sovereign and AI-ready solutions, SUSE empowers customers to escape vendor lock-in and regain control of their IT destiny. Through industry-leading Linux, Kubernetes, Edge and AI infrastructure solutions, SUSE delivers the flexibility to innovate everywhere – from the data center to multi-cloud and out to the edge. Only SUSE also manages many Linux and Kubernetes distributions. At SUSE, Choice Happens because we prioritize community, interoperability and relentless innovation. Discover how we power mission-critical resilience at www.suse.com.