The Third Operating System of Power – Part 3A: The Foundational Layer

BlackRock's Aladdin underpins the global financial system, while Palantir's Gotham connects data across government security agencies. But whose machines actually run these systems? The answer leads to Microsoft, Amazon, and Google - three American corporations that together control roughly 70 percent of Europe's cloud market. Whoever provides the computing infrastructure determines the technical conditions under which others operate. And under the US CLOUD Act, American legal authority can extend far beyond national borders. Part 3A of "The Third Operating System of Power" examines the invisible infrastructure upon which financial markets, security agencies, and increasingly entire governments are building their digital futures. The decisive question is: Who owns the foundation of digital sovereignty?

by Michael Hollister
Published at apolut media on October 23, 2026

5.134 words * 27 minutes readingtime

The First Operating System of Power read here:
BlackRock, Aladdin, and the Invisible Infrastructure

The Second Operating System of Power read here:
How Palantir Connects and Divides Germany’s Security Agencies

Who Provides the Computing Power the Others Run On

On December 01, 2025, BlackRock announced that its Aladdin investment platform would also run in Amazon’s data centers. The world’s largest asset manager described the move as an expansion of choice for its clients. Amazon spoke of secure, scalable infrastructure. And Sudhir Nair, who heads BlackRock’s Aladdin business, delivered the sentence that matters: The platform was “built to be multi-cloud.” The first major user named was Amazon’s own treasury department; general availability for US clients was announced for the second half of 2026.

Five years earlier, in April 2020, the same software had already moved once – to Microsoft’s cloud. That same year, Microsoft CEO Satya Nadella stood on a stage in Bengaluru and explained what his company intended to do with that cloud. “We are building Azure as the world’s computer,” he said.

Two statements, 5 years apart, with the same underlying structure. Aladdin, the operating system of the financial markets, does not run on hardware of its own. It rents its computing power – first from Microsoft, and now additionally from Amazon. And it is not alone.

Beneath the private operating systems of power mapped in this series so far lies a third layer that rarely appears in debates about digital sovereignty: computing power itself. The first 2 parts described what these systems do and who owns them – BlackRock’s Aladdin, which supports the investment processes of more than 1,000 institutions, and Palantir’s Gotham, which connects the most sensitive data held by police, military, and intelligence agencies. What both parts left unanswered was the question of where these systems physically run. Whoever provides the machines and networks provides the ground on which everything else stands. In Europe, that ground belongs almost entirely to American corporations. This is not a secondary aspect of the sovereignty debate, but its least-discussed foundation.

The Question Beneath the Others

The question posed by this third part is easier to state than to answer: Who supplies the computing power on which the private operating systems of power run – and what follows when that foundational layer is concentrated in a few hands and subject to a foreign legal order?

Part 3A describes the layer and its owners. It initially remains with the 2 systems already familiar from this series and asks what supports them technically. Part 3B will take the next step into Germany and examine what happens when a state builds its own administration on precisely this layer and calls the shell placed over it “sovereign.” The division is not arbitrary. It follows the construction of the system itself: first the level at which computation occurs, then the level at which a polity decides to whom it will entrust that capacity.

Precision matters here because the foundational layer is inconspicuous. No one sees it in everyday life. A fund manager working with Aladdin, an investigator using a Palantir interface, or a caseworker in a government agency – all see the application, not the data center in which it runs. That invisibility is precisely what makes the layer interesting. What goes unnoticed is not negotiated.

Two Operating Systems, a Reminder

Part 1 of this series described Aladdin, the technology platform of asset manager BlackRock. More than 1,000 organizations worldwide – pension funds, insurers, central banks, and competing asset managers – run their investment processes on the same software, with a 3-year retention rate of 98 percent. As of March 2026, BlackRock itself managed approximately $13.9 trillion. The term with which that first part concluded was not a metaphor: Aladdin is an operating system, the foundational layer on which investment processes run, and switching costs increase with every interface an institution adapts to it.

The second Aladdin analysis followed this architecture into German politics and the financial interests surrounding it. The next part of the series found the same logic in a different place, inside the state’s coercive apparatus: Palantir’s Gotham platform connects police, intelligence, and military data. In the English version of its judgment of February 16, 2023, the German Federal Constitutional Court expressly called Gotham an “operating system”. Here too, lock-in arises primarily not from contracts, but because the platform grows into an institution’s workflows and cannot easily be extracted again.

The first Palantir analysis showed how deeply the system already sits inside Germany’s security apparatus and how controversial it remains. While Bavarian police use the platform to search approximately 39 million personal records, the Bundeswehr rejected the same software as an unacceptable security risk. Two agencies of the same state, the same company, and 2 opposing judgments. The dispute concerned the operating model and embedded engineers who maintain the platform and may potentially gain insight into what runs on it. What remained unspoken in that debate was the layer beneath it. The data centers carrying these systems were not discussed, even though they present the same question in an intensified form. Anyone who fears visibility into a platform should ask even more urgently whose machines execute it.

Lock-in is operational in both cases, not contractual. It develops because the platform grows into an institution’s operating structure, binds trained employees, calibrates data histories and interfaces to its own formats, and shapes daily workflows. The difficulty of leaving became visible when Swiss banking giant UBS terminated an Aladdin contract inherited from Credit Suisse in July 2025 and had to migrate hundreds of funds to internal systems – the rare proof that departure is possible, but constitutes a major project. BlackRock markets its platform as a “whole portfolio” system, a single infrastructure for public and private markets, analytics, trading, and reporting. The more completely this infrastructure carries the work of an institution, the less replaceable it becomes.

Two systems, the same architecture, and the same term. One processes money; the other processes suspicion. Both combine what was previously separated, both impose a model on raw data, and both are black boxes to their users. They also share a characteristic that Part 2 of the Palantir analysis touched on but did not examine fully: They do not own the machines on which they compute. They run on something. That something is the subject of this part, and it is both the least visible and the most difficult layer of the entire structure to replace.

Aladdin on Someone Else’s Computing Power

On April 07, 2020, BlackRock and Microsoft announced a strategic partnership: Aladdin’s infrastructure would henceforth be operated on the Microsoft Azure cloud platform. Rob Goldstein, then as now BlackRock’s chief operating officer, said the move would expand capabilities for Aladdin clients. Microsoft’s Judson Althoff spoke of bringing Aladdin to the cloud. The stated purpose was sober and logical: more computing capacity to accelerate the platform’s development, and Azure’s global data centers to meet clients’ local requirements without abandoning BlackRock’s own standards for resilience and security. Hosting does not mean that a server is rented somewhere while everything else remains unchanged. It means that computing workloads, data storage, and failover protection move into the provider’s data centers; its services, tools, and interfaces become the environment in which the platform grows; and every subsequent development builds on that environment. Such a move is not a logistical decision. It is a decision about whose technology the product will breathe in the future.

What sounds technical in the announcement is a strategic decision. A platform on which much of the institutional investment world already depended moved its foundation to a single American technology corporation. BlackRock remained the owner of the software, the models, and the ontology of its financial world. But the machines on which all of that ran now belonged to someone else. The year was not coincidental. In 2020, Nadella called Azure the world’s computer; it was also the year in which one of the most powerful private financial systems moved onto that computer. The technology division to which Aladdin belongs generated approximately $2 billion in revenue in 2025, one-quarter more than the year before – a growing business that nevertheless rests on someone else’s computing power.

The second half of the transition followed 5 years later. On December 01, 2025, BlackRock entered into its partnership with Amazon Web Services, the world’s largest cloud provider. AWS announced that Aladdin would now run on its infrastructure as well; Sudhir Nair described the step as central to the platform’s multi-cloud capability. Amazon Treasury, the department that manages Amazon’s own global investment portfolio, was named as the first user. Microsoft’s Azure does not appear anywhere in the AWS announcement, and that is not an accident of public relations. It is the logic of the arrangement. An operating system distributed across 2 hyperscalers is no longer dependent on either one individually – and yet it remains within the same circle of American providers. The choice BlackRock promises its clients is a choice between Seattle and Redmond.

This distribution across 2 providers can also be read as the opposite of dependence, and that interpretation must be acknowledged. A multi-cloud platform cannot be held hostage by a single provider; if one fails or raises prices, the other can take over. Nair presents the AWS partnership in precisely those terms: choice and an open, flexible platform. Within the logic of an individual contract, that is correct. Within the logic of the overall structure, it changes nothing. The choice is between 2 American hyperscalers subject to the same legal jurisdiction. It reduces the risk of a single failure, not dependence on a particular circle of providers.

The finding is unspectacular and therefore remarkable. The operating system of the financial markets does not own its computing power. It rents it from Microsoft and Amazon. The reach described in Part 1 – more than 1,000 institutions, trillions in assets, and a retention rate from which hardly anyone departs – rests on the data centers of 2 corporations that have nothing to do with asset management and whose business is to provide the foundational load of the digital world. The more institutions process their investments through Aladdin, the more of global finance’s computing workload ends up on these same 2 infrastructures.

Palantir and the Layer That Reaches Every Environment

Palantir’s case is different and ultimately leads to the same point. The company does not sell its software as a finished product. It operates the software in the client’s environment, often in isolated data centers without an internet connection. One might assume that a system handling the state’s most sensitive data would stand on its own hardware behind thick walls. That is partly true. Most of the time, it is not.

In an in-house technical article, Palantir describes how its platforms actually operate. The “vast majority of deployments,” it states, are “hosted in AWS or Azure”. Palantir therefore runs its software on the same 2 American clouds to which Aladdin has migrated. The same 2 names appear as soon as one looks beneath the surfaces of both operating systems. That is not a coincidence, but an expression of how narrow the market for computing power has become.

For the US government, the company has built dedicated certified environments. In December 2024, Palantir received FedRAMP High authorization, the highest security level for US federal government cloud services, permitting particularly sensitive, nonpublic government data to be processed in the cloud. Alongside these environments are isolated installations for classified information that operate without internet connectivity in secured data centers – precisely the operating model described in the first Palantir analysis as a point of dispute for the Bundeswehr and the domestic intelligence service, with embedded engineers maintaining the platform. But the backbone of the business, the great majority of deployments, resides in the commercial clouds of 2 American corporations.

The real point, however, is another one, and it has a name: Apollo. Palantir’s fourth platform is not an analytical tool but a management layer above all the others. According to Palantir’s own documentation, Apollo manages software “centrally across independent environments, regardless of where they are located” and supports “all major cloud, on-premises, and air-gapped environments.” A company technical article calls Apollo the “puppet master” of the entire fleet: Administrators centrally determine which software version and configuration should apply, and Apollo ensures that every individual installation – whether in the cloud, in a data center, or behind an air gap – reaches that state. Apollo does not establish an inbound connection to every environment. Instead, local instances retrieve their instructions from Apollo, allowing control across segregated and intermittently connected networks. Apollo “manages the entire fleet” of Gotham and Foundry deployments.

This creates a second layer above the computing power. The first is the cloud on which Palantir runs; the second is the control instance that determines which software that cloud executes. Both are American, and the second is so in 2 respects: Apollo is itself the product of a US corporation and is subject to the same legal system as the clouds it orchestrates. A government agency operating Palantir in an isolated environment may believe it stands beyond all foreign reach, yet the environment continues to receive its updates from a layer the agency does not control.

This is the central point of the foundational layer. Palantir does not merely run on American computing power. The company has built its own control layer that determines what runs across every environment – and that layer is necessary because the world of data centers in which Palantir operates no longer consists of a single machine, but of a patchwork of clouds, isolated islands, and government systems. Anyone seeking to command that patchwork needs a layer above it. Apollo is that layer. The security operating system therefore rests on an American infrastructure and is administered through a level subject to American law.

The 2 systems approach the same outcome from opposite directions. Aladdin openly rents capacity from 2 hyperscalers and calls it choice. Palantir encapsulates its installations all the way into an air-gapped server room and still retains the strings through Apollo. One is dependence through rental; the other is dependence through control. What they share is the origin of the layer that ultimately matters.

The World Computer

The sentence with which Nadella described Azure in 2020 was not marketing in the conventional sense. It was a declaration of an intended reality. Speaking in Bengaluru, Nadella supported it with 2 figures: 50 billion connected devices by 2030 and a 4-fold increase in generated data to 175 zettabytes by 2025. A world that computes and stores on such a scale requires an infrastructure capable of carrying it – and Azure, he said, was being built to become that infrastructure, a distributed computing system functioning like a single computer. Microsoft presented the speech under the title “Building Azure as the World’s Computer”.

For a decade and a half, Microsoft, Amazon, and Google have been building precisely this infrastructure, which is no longer 1 product among many, but the prerequisite under which other products can exist at all. Computing power is becoming electricity from a wall socket: It is consumed, measured, and billed by usage. And as with electricity, the decisive question is not who switches on which lamp, but who owns the grid to which everyone is connected.

In Europe, the answer is unambiguous. According to figures from Synergy Research, European cloud providers together hold approximately 15 percent of their own home market. Amazon, Microsoft, and Google collectively account for approximately 70 percent. As recently as 2017, European providers held about 29 percent; since then, their share has almost halved and has remained at roughly 15 percent since 2022. The movement is noteworthy because it is not taking place in a shrinking market. Europe’s cloud market is growing rapidly, and European providers are growing too – their revenue tripled in the years through 2024. But the overall market is expanding faster, and it is expanding primarily for the 3 American corporations. European companies are increasing revenue while simultaneously losing market share. It is growth in the shadows: becoming larger and smaller at the same time when measured against the company standing beside you.

This is the foundational layer examined in this part. Not the software that is visible, not the interface used by a government caseworker or fund manager, but the level beneath it: the data centers, networks, and services from which everything else is delivered. Aladdin runs on it. Palantir runs on it. And in Europe, more than two-thirds of this layer is supplied by an oligopoly of 3 companies, all subject to the same legal jurisdiction. Anyone operating something digitally significant in Europe today – a bank, a government agency, or a corporation – is highly likely to encounter 1 of these 3 names, not as an option among many, but as an almost unavoidable prerequisite.

An honest analysis must acknowledge the other side of this finding. The dominance of the hyperscalers is not a conspiracy but the result of genuine economies of scale. A company operating data centers around the world can provide capacity more cheaply, reliably, and quickly than a national competitor. Government agencies and corporations have sound commercial reasons for using those services. The American providers also lead because they invested earlier and more decisively than their European competitors. The point of this article is not that this is reprehensible. The point is that it creates a dependence whose reach extends beyond the commercial decision.

Why the Foundational Layer Is the Real Power

The previous parts of this series described lock-in at the application level: the ontology into which a government agency pours its work, and the risk architecture through which an asset manager thinks. The foundational layer lies beneath them, and lock-in there is of a different kind. It concerns not which software someone uses, but whether the machines compute at all.

Whoever supplies the computing power sets the conditions. The provider determines prices and can change them. It decides which services remain available and for how long, and which are discontinued. It determines the technical standards and the cost of moving to another provider. And it is subject to a legal system that imposes obligations in which the client has no say.

The 2 operating systems of power sit on this layer like a house on leased land. As long as the lease remains in force and no one terminates it, the distinction from ownership is invisible; daily life inside the house is the same. The distinction becomes visible only when the landowner wants something the tenant does not – or when an authority with jurisdiction over the owner orders something that affects the tenant. It then becomes clear that the house never belonged to the occupant in the relevant sense; the decisive power belongs to whoever owns the ground beneath it.

This comparison is not rhetorical decoration, but points to a specific legal reality. Microsoft, Amazon, and Google are subject to the US CLOUD Act, which can require American providers to disclose data regardless of where in the world those data are physically stored. Whether and when that instrument is used against European clients is a question the next part will examine through specific cases. For present purposes, the structural finding is sufficient: The instrument exists, it is attached to the foundational layer, and no contractual clause at the application level removes it.

Whether the instrument is used is a different question, and this article does not decide it. The capability is documented, not the intent. There is no evidence that Microsoft, Amazon, or Google have used their position against European clients to control Aladdin or Palantir, and it would be dishonest to turn a mere possibility into an act. What is notable is the structure rather than an incident: The 2 systems whose reach was described in the first 2 parts rest on a layer that is even more concentrated and more unambiguously American than the systems themselves.

Cui bono – who benefits – is not an insinuation here, but a question of structure. Every additional migration to the cloud shifts more computing power, data, and dependence into the same circle of 3 corporations. Closing that circle is their business model, and there is nothing disreputable about pursuing a business model. What would be disreputable is pretending that the foundational layer is neutral – as though computing power could be obtained without also taking the hand that supplies it and the legal order that governs that hand.

The structure can be imagined as a 3-story building. On the top floor are the applications people use, the screens and interfaces. In the middle are the operating systems of power, Aladdin and Gotham, which organize what happens above. And in the basement, from which the building receives its energy, is the foundational layer: the hyperscalers’ data centers. Public debate over digital sovereignty takes place almost exclusively on the upper floors. It asks which software an agency uses, which corporation owns a dataset, and which analytics platform is purchased. It rarely asks who owns the basement. This third part reverses the line of sight. It begins in the basement because that is where the lines supplying everything else converge.

There is a further consideration that distinguishes the foundational layer from the application layer. At the application level, a client can at least theoretically change products; UBS demonstrated that it can be done, however arduous the process. At the foundational level, switching is far more difficult because there are scarcely any places to which one could move. Anyone leaving Microsoft arrives at Amazon or Google. Anyone seeking to leave all 3 finds a European offering that carries 15 percent of its own market and, across many services, cannot match the breadth of the hyperscalers. The dependence runs deeper because the alternative is thinner.

This opens the question that will carry the second half of this third chapter. It no longer asks who operates the private operating systems, but what it means when a state places its own administration on the same foundational layer – and whether the shell it puts over that layer and calls “sovereign” is more than a word.

Finding

Beneath the operating system of the financial markets and the operating system of the security state lies the same layer: the computing power on which both run. Aladdin moved to Azure in 2020 and additionally to AWS in 2025. Palantir operates most of its deployments in AWS or Azure and controls them through a proprietary management layer that reaches every environment. And in Europe, approximately 70 percent of the market from which this computing power is obtained belongs to 3 American corporations.

The third operating system of power is therefore not a fourth system alongside the other 2. It is the ground beneath them. Whoever provides that ground does not possess a switch in a single house, but the land on which the houses stand. That is not, in itself, a judgment about intent. It is a determination of location – an answer to the question of where the power examined in this series resides.

This finding carries no moral sign. Companies build data centers and rent out their capacity as a business; clients use them for rational reasons. The observation is both more sober and more severe: The power examined in this series is greatest not where it is usually suspected – not in the software being operated, not even in the corporations whose names dominate the headlines – but 1 level below, among those who supply the current from which everything else draws its energy.

The second half of this determination leads to the point where private infrastructure becomes a matter of state. A country that has made digital sovereignty its guiding concept is building its administration on precisely this layer – and purchasing sovereignty as a surcharge on the invoice of the same corporation from which it sought independence. That is the subject of Part 3B.

No advertisers, no sponsors, no political patrons – this publication is funded by its readers. Support independent geopolitical analysis from $5 per month and unlock all member-only content.

You are also welcome to support my work with a one-time donation.

About the Author

Michael Hollister
is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.


The crucial question is often not what happened, but why. That is where my analysis begins.

Sources

Corporate and Technology Sources
Market and Structural Data
Court Document
Earlier Analyses in This Series

© Michael Hollister – Republishing Expressly Encouraged.
I am pleased when my articles, contributions, and analyses generate interest and are shared with a wider audience. The reproduction, distribution, and republication of my texts, either in full or in part, on other websites, blogs, or in any other publications is expressly permitted and encouraged. No prior permission is required.

The only requirements: Michael Hollister must be clearly and visibly credited by name as the author. In addition, a prominent, clickable link to the original website, www.michael-hollister.com, must be included.

Any reuse without proper author attribution and a link to the original website is prohibited.

PDF 📄

Mehr zu diesem Thema