A synthesis of findings derived from public procurement contracts, the statutory architecture of OUG 89/2022, and the national interoperability framework.
Romania's Sovereign Government Cloud (CPG) centralizes 136 primary public databases—spanning identity (DEPABD), bank accounts and taxes (ANAF), health records (CNAS), property deeds (ANCPI), and criminal records (Ministry of Justice).
While critical cybersecurity (operated by SRI UM 0296) received a 668M RON PNRR contract and application migration reached 243.8M RON, the citizen-facing access logging and notification platform was awarded at just 4.7M RON (0.3% of the total).
Under Emergency Ordinance OUG 89/2022 (Art. 14) and Decision HG 372/2022, queries performed for national security, defense, public order, or criminal prosecution (SRI, DGPI, SIE, DNA, DIICOT) are strictly exempt from notifying the affected citizen.
The infrastructure is partitioned into three concentric security rings: Ring 1 Dedicated (physically isolated, run by STS, defended by SRI), Ring 2 Private Gov, and Ring 3 Hybrid Edge, across 4 primary data hubs: Bucharest, Brașov, Sibiu, and Timișoara.
Across the 20 subsequent contracts awarded under the 743M RON migration framework (totaling 243.8M RON), Connections Consult secured lots 19 and 20, capturing 143.03 million RON.
While the EU RRF / PNRR milestone deadline hit on 31 August 2026, dozens of municipal registries remain trapped on legacy servers, and row-level access logging shims remain incomplete across legacy state software.
Primary data from SICAP procurement records and EU Recovery and Resilience Facility (PNRR) Component 7 budgets.
Out of roughly 954 million RON awarded across primary Cloud components, the citizen logging safeguard received under 0.5%.
668.000.866 lei (69,8%)
SICAP 100636614 · Logic Computer & Digi
243.807.248 lei (25,5%)
SICAP 100645720 · Connections (58,7%), Maguay, NTT
37.570.232 lei (3,9%)
SICAP 100648317 · ASEE Solutions
4.707.860 lei (0,5%)
SICAP 100632251 · Orange Romania
Established under Government Emergency Ordinance OUG 89/2022 and Technical Decision HG 372/2022.
Dedicated hardware infrastructure, physically and logically isolated. Hosts national security, defense, public order, classified data, and primary national identity registers.
High-availability virtualized environment on sovereign servers. Hosts administrative state databases: taxes (ANAF), healthcare (CNAS), civil justice (ECRIS), labor (REVISAL), land cadastre (ANCPI).
Unclassified public digital services, citizen information portals, elastic compute for research, open government data distribution, and consular web services.
High-availability, Tier III+ and Tier IV ready computing hubs ensuring national disaster recovery.
Select an authority inquiry to observe cross-database paths, audit logging, and legal notification outcomes under OUG 89/2022.
Verificarea veniturilor nedeclarate și a patrimoniului.
Conform OUG 89/2022, interogările fiscale antifraudă sunt consemnate în jurnal, dar notificarea cetățeanului este suspendată până la închiderea controlului.
Search and filter all public registries by domain, sensitivity tier, security ring, or specific personal data held.
Itemized breakdown of the subsequent contracts awarded under ADR framework tender SICAP 100645720.
| # | Notice No. | Winning Contractors | Scope of Work | Days-Man | Value (RON) |
|---|---|---|---|---|---|
| 1 | CAN1155065/1 |
MAGUAY COMPUTERS, PHOENIX IT | Legacy x86 architecture migration, Oracle/SQL database clustering | 3.840 | 3.027.040,00 |
| 2 | CAN1155065/2 |
PricewaterhouseCoopers Management Consultants | Government app compatibility audit and cloud architecture design | 3.200 | 3.023.882,25 |
| 3 | CAN1155065/3 |
SC Evozon Systems SRL | Microservices containerization and REST API refactoring for public portals | 1.680 | 1.334.830,00 |
| 4 | CAN1155065/4 |
NTT DATA ROMANIA | Financial management systems and administrative ERP migration | 2.500 | 2.117.020,00 |
| 5 | CAN1155065/5 |
ENDAVA ROMANIA | Source code optimization and sovereign secure CI/CD pipeline rollout | 1.950 | 1.607.473,90 |
| 6 | CAN1155065/6 |
METAMINDS, TRENCADIS CORP, ONE SOFTWARE, EASYDO Digital Technologies | National interoperability registry integration and middleware hardening | 4.200 | 3.719.842,50 |
| 7 | CAN1155065/7 |
ALTIMATE | Geospatial and GIS data system migration for territorial management | 1.200 | 994.330,00 |
| 8 | CAN1155065/8 |
WING LEADING EDGE | Source code security assessment and pre-migration vulnerability auditing | 1.450 | 1.237.373,12 |
| 9 | CAN1155065/9 |
WING LEADING EDGE | Penetration testing and application hardening for Level 2 classification | 1.380 | 1.174.840,30 |
| 10 | CAN1155065/10 |
AROBS SYSTEMS SRL, CLOUD SOFT, Software Imagination & Vision | Educational registry and academic database module migration | 1.300 | 1.059.068,75 |
| 11 | CAN1155065/11 |
MAGUAY COMPUTERS, PHOENIX IT | Distributed storage configuration and synchronous backup across CPG nodes | 1.100 | 892.594,00 |
| 12 | CAN1155065/12 |
WING LEADING EDGE | GDPR compliance reports and personal data traceability auditing | 1.150 | 976.780,00 |
| 13 | CAN1155065/13 |
PHOENIX IT, MAGUAY COMPUTERS | Major critical infrastructure migration package: servers, SAN, virtualization | 38.500 | 66.377.700,00 |
| 14 | CAN1155065/14 |
PricewaterhouseCoopers Management Consultants | Change management, technical assistance, and SOP development for ministries | 1.800 | 1.564.220,00 |
| 15 | CAN1155065/15 |
NTT DATA ROMANIA | High-volume transactional database migration and high-speed clustering | 4.100 | 3.692.420,00 |
| 16 | CAN1155065/16 |
WING LEADING EDGE | Application security monitoring and Cyberint standards compliance | 1.750 | 1.534.023,33 |
| 17 | CAN1155065/17 |
SQS BUSINESS SERVICES S.R.L., SIQSESS TECHNOLOGY S.R.L. | Automated performance and scalability testing of cloud service interfaces | 4.300 | 3.962.150,00 |
| 18 | CAN1155065/18 |
SIQSESS TECHNOLOGY S.R.L., SQS BUSINESS SERVICES S.R.L. | Integrated dataflow auditing and transfer protocol validation | 2.800 | 2.477.660,00 |
| 19 | CAN1155065/19 |
Connections Consult | Major Migration Package 1: large-scale central administration app migration | 52.000 | 99.146.000,00 |
| 20 | CAN1155065/20 |
Connections Consult | Major Migration Package 2: optimization, integration, and CPG go-live | 24.500 | 43.888.000,00 |
| TOTAL 20 SUBCONTRACTS AWARDED | 155.600 | 243.807.248,15 lei | |||
Rigorously separating facts, procurement citations, analytical deductions, and potential falsification bounds.
„SRI (via UM 0929 and UM 0296) is not merely securing its own servers, but deploying an active cyber shield across all critical public nodes connected to CPG.”
The 668,000,866 RON ex-VAT award and technical specifications for enterprise EDR/XDR and SIEM licenses cover 120,000–140,000 endpoints, confirming Ring 1 monitors the perimeter of all central administration.
„The 4.7M RON allocated to Orange Romania is insufficient to retrofit row-level logging into 136 legacy apps; it pays for a message broker and unified web portal.”
At 4.7M RON (~€940,000) across 136 applications, per-system budget would be under €7,000, proving the platform is a central event consumer relying on external API hooks provided by migration contractors.
„By securing lots 19 and 20 (totaling 143.03M RON), a single corporate group holds 58.7% of all migration values awarded to date.”
No other competitor in the 23-vendor framework received single awards of this magnitude; the next highest joint venture (Phoenix IT & Maguay) reached 66.37M RON on lot 13.
„CPG governance is strictly dual: ADR manages civilian ministry policies, but STS and SRI retain exclusive custody of encryption keys, access tokens, and Ring 1 physical nodes.”
The 3-ring statutory framework mandates that Ring 1 shares no compute or storage fabric with Ring 2; all cross-boundary communications pass through encrypted inspection gateways controlled by Cyberint.
„When an authority queries citizen records, the alert will likely state that the general record was accessed, without distinguishing whether the agent viewed income, diagnosis, or just the address.”
Most Romanian state databases built between 2000 and 2015 lack column-level logging, recording only table-level transactions (SELECT WHERE CNP=...).
„By consolidating bank accounts, wages, real estate, and vehicle titles, PatrimVen reconstructs the complete economic lifestyle of any Romanian citizen.”
PatrimVen is queried daily by over 3,500 institutions (municipalities, courts, bailiffs, prosecutors, police), serving as the primary multi-domain personal data nexus.
„Consolidating 136 registries into a single interconnected fabric means an identity or gateway breach threatens cascading compromise across all state branches.”
The July 2026 ANCPI ransomware attack demonstrated that lateral movement across unsegmented networks paralyzed national land registry for weeks; in CPG, microsegmentation is the sole defense.
„Geographic distribution across Bucharest, Brașov, Sibiu, and Timișoara shields the state against regional power failures or kinetic strikes on the capital.”
Sub-5ms latency between Bucharest and Brașov/Sibiu enables synchronous database replication for Ring 1, guaranteeing zero-data-loss continuity if a primary node collapses.
This public investigation was assembled using strictly public procurement registers (e-licitatie.ro / SICAP), Government Emergency Ordinances (OUG 89/2022), Government Decisions (HG 372/2022), and technical annexes published under Romania's National Recovery and Resilience Plan (PNRR Component 7 - Digital Transformation).
Privacy & Zero Personal Data Guarantee: No actual personal citizen data is queried, stored, or processed on this website. All demonstrations, metrics, and simulations model the public administrative architecture and statutory access rules established by the Romanian state.