Cloud Sovereignty Framework

How sovereign is your cloud?

Measure your digital sovereignty against the European Commission's Cloud Sovereignty Framework. Start with the 2-minute quick check, or go deep with the full assessment. Either way you'll get your Sovereignty Score, your SEAL assurance level, and exactly what is holding it back.

Quick check 0 / 16 answered

SOV-1 · Weight 20% Strategic Sovereignty The degree to which a provider is anchored in the EU legal, financial and industrial ecosystem — ownership, governance influence and alignment with EU priorities.

Decision-making authority

Where does ultimate decision-making authority over the service reside?

Entirely outside the EU Mostly outside the EU Mostly within the EU Entirely within the EU

Change of control risk

How likely is a takeover of the provider by, or transfer to, a non-sovereign owner?

Very likely Likely takeover by or transfer to a non-EU sovereign entity Somewhat likely takeover by or transfer to a non-EU sovereign entity Unlikely takeover by or transfer to a non-EU sovereign entity Very unlikely

Control over roadmap

How far can EU stakeholders shape the provider's technological and service evolution?

No influence possible Through “voice of the customer” public channels (feedback portals, online communities) Governance bodies exist with EU actors participating Full influence of EU actors

Financial independence

How far does the provider rely on EU-based financing rather than external capital?

Almost entirely reliant on non-EU funding Mostly reliant on non-EU funding Balanced mix of EU and non-EU funding Majority of funding is EU-based Entirely EU-based funding

EU economic contribution

What share of investment, jobs and value creation sits within the EU/EEA?

Minimal Some Balanced EU / non-EU Majority in the EU Fully in the EU

EU strategic programmes

How far is the provider involved in EU strategic programmes (IPCEI-CIS, Horizon Europe, Gaia-X)?

No clear participation Active participant in strategic projects Strategic projects depend on the provider's involvement

EU industrial strategy alignment

How consistent is the provider with EU digital, green and industrial sovereignty objectives?

No evidence exists An action plan exists Achievement already measured, with dedicated governance in place Bold ambition backed by dedicated means

Resilience to cut-off

Could the service sustain secure operations if vendor support were withdrawn or disrupted?

Immediate shutdown of the service is expected The service would likely stop, but with a delay allowing time to react Can continue temporarily under a contractual agreement Alternative suppliers could be sourced, or key functions internalised Full autonomy and continuity

SOV-2 · Weight 10% Legal & Jurisdictional Sovereignty The legal environment, exposure to foreign authority and enforceability of rights — how far the service is insulated from external legal claims.

Primary legal jurisdiction

Which national legal system governs the provider's operations and your contract?

Non-EU only Mixed EU / non-EU Exclusively EU law

Extraterritorial laws

How exposed is the service to non-EU laws with cross-border reach (US CLOUD Act, Chinese Cybersecurity Law)?

Fully exposed to non-EU laws Mitigation clauses exist, but exposure remains EU subsidiary with contractual protections Legal structures shielding from foreign law Verified legal immunity — non-EU laws unenforceable

Data access pathways

Could non-EU authorities compel access to your data or systems, and would you be told?

Non-EU authorities can compel access without customers being notified Non-EU authorities can compel access without customers being notified, in specific cases Non-EU authorities can compel access, with customers notified in all cases Requests are disputed by the provider and in some cases eventually accepted, with customers notified Requests from non-EU authorities are always rejected by the provider

Export control restrictions

How far do international regimes such as ITAR or EAR restrict use or transfer of the service?

Restrictions exist towards an EU Member State Restrictions exist towards EU citizens or international organisations Share of revenues above 50% in the EU Part of the offer cannot be exposed to restrictions towards EU Member States Part of the offer cannot be exposed to restrictions towards EU Member States or international organisations

Origin of IP

Where is the intellectual property created, registered and developed?

Entirely outside the EU Mostly outside the EU Mixed within / outside the EU Mostly within the EU Fully within the EU

IP holder jurisdiction

Under which jurisdiction are the IP rights owned and enforced?

Non-EU law, a single country Non-EU law, mixed non-EU countries Mixed law, some EU EU law with exceptions Fully under EU law

SOV-3 · Weight 10% Data & AI Sovereignty Protection, control and independence of data and AI — who holds the keys, where data is processed, and how much autonomy you keep over AI.

Control over encryption keys

Who has effective control over cryptographic access to your data?

The provider only Primarily the provider, but not exclusively Shared — the provider holds override keys Customer has primary control, but the provider can read some or all of the data Customer has exclusive control — the provider cannot read the data

Data flows & access logs

How visible is it when, where and by whom your data is accessed, including AI model usage?

No data usage logs Basic logs, incomplete (missing date, user, type of access or means of access) Logs exist but are not real-time, or are not controlled by the customer Full customer-controlled visibility of log access, but not in real time Real-time customer oversight with independent auditability

Secure deletion & proof of erasure

Can irreversible deletion of your data be guaranteed and evidenced?

No — irreversible deletion is neither guaranteed nor verifiable Manual confirmation only Internal validation against policy, leaving no proof Deletion is technically verified, with access logs Irreversible deletion is systematically enforced and independently verified

Data location in EU/EEA

Where are your data stored and processed, and can processing fall back to third countries?

Location largely unknown, and includes third countries without controls Partly in the EU, with significant reliance on third countries and limited control Mainly in the EU, with some third-country use under standard safeguards In the EU by default, with tightly controlled exceptions Exclusively in the EU, with no third-country fallback

AI services

How far are AI models and data pipelines developed, trained, hosted and governed under EU control?

Non-EU or undetermined — black-box AI, restricted chips Mostly non-EU dependencies — licensed AI, chip dependency Mixed control with alternatives — auditable or open-source AI, foreign chips EU-led AI, foreign accelerators EU-origin models and chips, with no dependencies outside the EU

SOV-4 · Weight 15% Operational Sovereignty The practical ability of EU actors to run, support and evolve the technology independently of foreign control.

Portability & interoperability

How easily can workloads migrate to, or interoperate with, alternative EU-controlled solutions?

No guarantees are provided for data or workload portability Data export and workload portability on a best-effort basis Standard documented methods for data export are available Formal migration services are available to assist with moving data and workloads The solution is already deployed on sovereign infrastructure

Operating without foreign dependencies

Can EU operators manage, maintain and support the technology without non-EU vendor involvement?

Critical operational services are delivered by non-EU teams Operational services are partially sourced from within the EU Operational responsibilities are balanced between EU and non-EU teams Operational services are predominantly delivered by EU-based teams The entire stack is managed and supported by a fully EU-based team

Skill availability

Is there an EU-based talent pool with the expertise to operate and sustain the service?

Global team, mainly non-EU Mixed, majority outside the EU Majority EU, with escalation abroad All EU staff All EU staff, holding relevant security clearances

Support channels

Where is operational support delivered from, and under whose law?

The support team is global, with the majority of staff outside the EU The team is mixed, but the majority of support staff reside outside the EU The majority of support staff are in the EU, but escalations are handled by non-EU teams All support staff are located within the EU All support staff are within the EU and hold relevant security clearances

Documentation & knowledge transfer

Where is technical documentation, source and operational know-how held?

Stored or managed outside the EU, and possibly subject to non-EU jurisdiction or access EU storage is available as an option, but is not enforced Stored in the EU by default, but some storage, replication or access outside the EU may occur (e.g. disaster recovery) All primary documentation and knowledge repositories are stored in the EU Content, metadata and backups are stored in the EU, with privileged access restricted to EU-based staff under EU jurisdiction

Subcontractor & supplier jurisdiction

Where are critical suppliers and subcontractors located, and under whose legal control?

Critical subcontractors are non-EU and outside any EU legal control Key subcontractors are non-EU, with contractual protections only Mixed — some critical subcontractors remain non-EU, but are documented and auditable Critical subcontractors are EU-based, with minor non-EU exceptions All critical suppliers and subcontractors are EU-based and EU-controlled

SOV-5 · Weight 10% Supply Chain Sovereignty The geographic origin, transparency and resilience of the technology supply chain — hardware, firmware and software.

Origin of components

How transparent is the geographic source of key physical parts?

No disclosure Partial disclosure Transparent with exceptions Full transparency EU-certified provenance

Manufacturing location

In which countries is the hardware manufactured or assembled?

Fully foreign, black box Foreign origin, partial disclosure Mixed sourcing, with EU audit rights Built by EU teams on the basis of a foreign design Exclusively designed and built by EU teams

Firmware provenance

What is the jurisdiction and provenance of the embedded code controlling the hardware?

No disclosure Partial disclosure Transparent with exceptions Full transparency EU-certified provenance

Origin of software

Where and by whom is the software architected and programmed?

Fully foreign origin, with no transparency (a black box) Foreign origin, with partial disclosure on its development Core and essential parts are designed and maintained by EU teams A large majority of the software is designed and maintained by EU teams The software is exclusively designed and maintained by EU teams

Packaging & distribution

Who governs and executes software build, release and deployment?

Non-EU control and execution — pipeline control and approvals under non-EU jurisdiction EU control, non-EU execution — executed by non-EU teams, but administration and final approvals under EU jurisdiction Non-EU control, EU execution — executed by EU teams, but administration or release signing under non-EU jurisdiction EU control and execution — executed by EU teams and governed from within the EU, including signing and approvals As above, plus EU-based compliance and security gates enforced in the pipeline (signing under your control, vulnerability checks, segregation of duties, auditable approvals)

Single point of dependency

How far does the solution rely on non-EU vendors, facilities or proprietary technologies?

Only non-EU vendors or facilities are involved Mostly non-EU vendors or facilities in critical services, undocumented Few non-EU vendors in critical services and undocumented, or non-EU vendors transparently documented Few non-EU vendors or facilities, in non-critical services only, and documented No dependency on any non-EU vendor or facility

Supply chain transparency

How far can the supplier and sub-supplier chain be audited?

No suppliers can be audited Some suppliers and subcontractors can be audited Critical suppliers and subcontractors can be audited Most suppliers and subcontractors can be audited All suppliers and subcontractors can be audited

SOV-6 · Weight 15% Technology Sovereignty Openness, transparency and independence of the stack — the ability to interoperate, audit and evolve without proprietary lock-in.

Interoperability & open interfaces

Can the service integrate through well-documented, non-proprietary APIs and protocols?

Closed proprietary interfaces — integrations rely on vendor-controlled interfaces and formats Restricted proprietary APIs — some vendor APIs exist but are limited in access, scope or licensing Mixed openness — key interfaces are documented and partly standards-based, but important functions or formats remain proprietary Standards-based and broadly compatible — interfaces predominantly follow recognised open standards (ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning Open by default with portability — all critical functions accessible via open, documented, non-proprietary APIs and standard formats

Open standards compliance

How far does the solution adhere to publicly governed, widely adopted standards?

No open standards — core services (identity, data formats, messaging, security, logging, integration) rely mainly on proprietary technology Ad hoc use — open standards used inconsistently, without documented rationale or governance Partial core adoption — open standards used and documented for some core services, others remain proprietary Policy for most core services — a formal policy mandates open standards for most core services, with managed exceptions Policy for all core services — a formal policy mandates and documents open standards throughout

Open source availability

Is the software available under open licences, with rights to audit, modify and redistribute?

Fully closed source, with no rights to audit or modify, and vendor-controlled governance Source available for review, but modification and handover rights under very strict conditions Open source permitting modification and redistribution, but governance is centralised (single company or non-open foundation), limiting strategic autonomy Open source with significant EU contributions, but restricted governance; handover is possible Fully open source governed by an independent or EU-based entity, granting full rights to audit, modify, redistribute and transfer stewardship

Architecture transparency

How visible are the service's design, data flows and dependencies?

No insight provided Insight accessible during audits Some public insight exists A large corpus of public insight exists Customers can contribute to adapt and enhance the service

HPC sovereignty

How EU-independent is high-performance compute — processors, accelerators and software ecosystems?

Imported black-box HPC systems EU-hosted, foreign stack Co-designed or integrated in the EU EU processor IP, non-EU fabrication EU design, EU fabrication and EU operation

SOV-7 · Weight 15% Security & Compliance Sovereignty The extent to which security operations, compliance and resilience are controlled within the EU.

Security certification

Which EU and internationally recognised security certifications does the service hold?

None (EAL0) EAL1 EAL2 EAL3 EAL4–5

EU regulatory compliance

How demonstrable is adherence to GDPR, NIS2, DORA and other EU frameworks?

No evident adherence to any EU regulation Limited compliance with some well-known EU regulations — basic practices exist but are informal or incomplete Moderate compliance with some well-known EU regulations — controls exist but gaps remain and compliance is not fully demonstrated Partial compliance with most well-known EU regulations — requirements implemented and operational, with minor exceptions Fully compliant with all well-known EU regulations, verified and independently audited

EU-based SOC & incident handling

Where do the security operations centre and incident-response teams operate, and under whose jurisdiction?

The SOC and incident-response teams are located outside the EU A hybrid model, with SOC functions split between EU and non-EU locations The primary SOC is in the EU, but incidents may be escalated to non-EU teams The entire incident lifecycle is handled by teams operating exclusively within the EU, with threat intelligence obtained mostly from EU sources The full incident lifecycle is handled by EU-based teams participating in ENISA's information-sharing frameworks, with threat intelligence gathered worldwide

Control over monitoring & logging

How far can you or an EU authority oversee security logs, alerts and monitoring directly?

The provider retains full control over all security logs and monitoring Customers receive periodic reports based on security logs Customers have access to a basic monitoring portal Customers have full direct access to their security monitoring and logs, stored in the EU Customers have full access to immutable, tamper-proof logs stored exclusively within the EU

Disclosure of incidents

How transparently and promptly are breaches and vulnerabilities reported, and can EU CSIRTs be involved?

No compliance — ad-hoc or absent breach reporting, with no way to collaborate with EU CSIRTs or support EU-led investigations Limited compliance — reactive reporting with limited transparency and no guaranteed timelines; CSIRT cooperation on a best-effort basis Moderate compliance — GDPR/NIS2-aligned reporting within mandated timelines; CSIRT cooperation available but not real-time Partial compliance — a monitored reporting flow with internal SLAs at or below regulatory maximums, contractually prepared to support EU-directed investigations Full compliance — EU-compliant breach disclosure with real-time sharing to EU CSIRTs, audit-backed processes, proactive vulnerability disclosure and proven investigation readiness

Maintenance autonomy

Can security patches be developed, tested and applied independently of non-EU vendors?

No autonomy in the deployment of security patches Limited autonomy — patches deployed on vendor schedules; basic testing possible Moderate autonomy — patches deployed with sufficient notice and testing possible, except for zero-day patching High autonomy — patches can be deployed independently by the customer, without customer checks Full autonomy — patches can be deployed independently by the customer, with customer checks

Auditability

Can EU entities perform independent security and compliance audits with full access?

No access for any entity other than the vendor Limited access for independent entities, to data provided by the vendor Partial control by independent entities over the data provided by the vendor High control by independent entities, able to request data from the vendor Full control for any independent entity to perform security and compliance audits

SOV-8 · Weight 5% Environmental Sustainability Autonomy and resilience over the long term — energy usage, dependency and raw-material scarcity.

Energy efficiency

How energy-efficient is the infrastructure, and are there measurable improvement targets?

PUE unknown or unmeasured PUE below 3 PUE below 1.5, with an improvement roadmap PUE below 1.3 PUE below 1.2, EU-verified

Hardware reuse & recycling

Are circular-economy practices applied to hardware — reuse, refurbishment and responsible end-of-life?

No policy Ad-hoc recycling only, with no documented policy A documented reuse and refurbishment programme A circular-economy programme aligned to EU practice EU-certified hardware lifecycle

Environmental impact reporting

How transparently are carbon emissions, water use and other sustainability indicators measured and disclosed?

No reporting High-level claims only, with no methodology Annual sustainability report Detailed reporting on an EU methodology EU-audited reporting

Energy supplies

How is the infrastructure powered?

Not traceable Partly traceable, predominantly non-EU supply A mix of EU and non-EU supplies Only EU energy supplies Only green EU energy supplies

Quick exposure check Two questions per objective For each of the framework's eight objectives: what typically describes you, then where your weakest link sits. Both are needed because the framework scores the average but sets your assurance level from the worst answer. Want per-criterion depth? Switch to the full assessment above.

SOV-1 · Strategic Sovereignty

Typical posture

Where do ownership, control and roadmap influence over your primary provider sit?

Non-EU owned and controlled, governed entirely under non-EU law Non-EU owned and controlled; an EU entity exists but EU law is hard to enforce in practice An EU entity autonomous in its organisation but not its technical choices — if access to the underlying technology broke, the service would keep running but without updates or security patches EU entity with access to the roadmap and a complete guarantee of operational continuity Decision-making centres exclusively in the EU, with European customers prioritised in roadmap arbitration

Weakest link

If access to the underlying technology were cut off tomorrow, and thinking about who really decides the roadmap — what is the weakest statement still true of you?

The service would shut down immediately, and we have no influence over the roadmap The service would stop after a grace period; influence is limited to public feedback channels The service would keep running under contract, but without updates or security patches We could source alternative suppliers or internalise key functions, and EU actors sit in governance bodies Continuity is fully guaranteed under EU control, with EU decision-making and roadmap priority

SOV-2 · Legal & Jurisdictional Sovereignty

Typical posture

How insulated is your provider from non-EU law (e.g. the US CLOUD Act) and from export-control measures?

Governed entirely by non-EU law; non-EU authorities can compel access to data or systems EU law formally applies but is hard to enforce, and the provider remains under non-EU control Isolated through separate EU entities, with limited exposure to export-control-type measures Complete insulation guaranteeing non-EU legislation is inapplicable, with no Member State exposed to export controls Operations designed and carried out exclusively in the EU, with international institutions also protected against export controls

Weakest link

The decisive test: could a non-EU authority compel access, and is your contract exclusively under EU law?

Export-control restrictions could be applied against an EU Member State Non-EU authorities could compel access — with or without notice — or the contract is not exclusively under EU law Contracts are exclusively under EU law and the provider always rejects non-EU requests; legal structures shield from foreign law and EU revenue share limits export-control exposure Non-EU legislation is verifiably inapplicable, and no Member State is exposed to export-control measures Operations are designed and carried out exclusively in the EU, and international institutions are protected too

SOV-3 · Data & AI Sovereignty

Typical posture

How much control do you have over your data — its keys, its location, its deletion and its access logs?

The provider controls the data and the keys, and location is unknown or outside the EU EU storage on paper, but the provider holds the keys and may process in third countries Full control of the data — you hold the encryption keys, data is localised in the EU, deletion is guaranteed, and access logs are available As above, plus AI designed in the EU and access logs recorded in real time in the EU As above, with immutable logs and audits carried out by European teams

Weakest link

At your weakest point on data — keys, residency, deletion and logs — what is still true?

Data location is unknown or includes third countries without controls, and there are no access logs The provider holds override keys, data may fall back to third countries, or deletion cannot be evidenced Data sits exclusively in the EU with no fallback, deletion is technically verified, and access logs are available As above, plus AI designed in the EU and logs recorded in real time in the EU Immutable logs audited by European teams, and you alone can decrypt

SOV-4 · Operational Sovereignty

Typical posture

Could EU teams run, support and exit the service without a non-EU vendor?

No — you're locked in and wholly dependent on a non-EU vendor Critical operations are delivered by non-EU teams and exit is impractical Operations are carried out and documented locally; expertise from outside the EU may still be necessary, but open, documented alternatives exist Expertise is available in Europe including subcontractors, and processes are designed and documented locally Complete European autonomy, including security clearances and the integration of key subcontractor skills

Weakest link

Where does a non-EU dependency still remain in running, supporting or exiting the service?

No portability guarantees, and documentation or know-how sits outside the EU Critical operations are delivered by non-EU teams, or most support staff are outside the EU Standard documented export methods exist and operations are documented locally, though non-EU expertise may still be needed Expertise is available in Europe including subcontractors, with all support staff in the EU Complete European autonomy, with security clearances and key subcontractor skills integrated

SOV-5 · Supply Chain Sovereignty

Typical posture

How EU-controlled and transparent is the hardware, firmware and software supply chain?

Opaque and predominantly non-EU Mostly non-EU, with little visibility and no audit rights The majority of the supply chain is documented, deployment is carried out locally (procedures may be external), and critical suppliers and subcontractors can be audited The majority of services are designed in the EU, deployed and orchestrated locally, with no subcontractors involved in critical services EU-certified component origin, EU design, build and compliance checks, no non-EU supplier dependency, and complete supplier auditability

Weakest link

At the least transparent point in your supply chain, what is still true?

Software is a foreign black box with no transparency on its development Hardware origin is undisclosed, updates are controlled outside the EU, or no suppliers can be audited The majority of the chain is documented, critical suppliers can be audited, and deployment is carried out locally Core software is designed and maintained by EU teams, with no non-EU vendors in critical services EU-certified component origin, no dependence on non-EU suppliers, and every supplier auditable

SOV-6 · Technology Sovereignty

Typical posture

How open, auditable and lock-in-free is the technology stack?

Closed and proprietary throughout, with no portability Vendor-controlled interfaces with limited, restricted export options The services are partially interoperable, and high-performance compute is hosted on-premises European and public standards for core services, a majority of open source with predominantly European contributors, and an auditable architecture Fully open — public standards, open source and EU open AI throughout

Weakest link

Where does proprietary lock-in or opacity still remain in the stack?

Closed proprietary interfaces, no open standards for core services, and imported black-box compute Vendor APIs exist but are restricted, and open standards are used only ad hoc Key interfaces are documented and partly standards-based, and high-performance compute is EU-hosted Open standards are mandated for most core services, majority open source with European contributors, and the architecture is auditable Open standards for all core services, fully open source, and EU-designed compute

SOV-7 · Security & Compliance Sovereignty

Typical posture

How EU-controlled are certification, security operations and audit rights? (This asks where your provider's security operations centre and incident response sit — not which regulations apply to you.)

No recognised certification, and security operations run entirely outside the EU Certified on paper, but the security operations centre and incident response sit outside the EU, or incidents may be escalated to non-EU teams EAL2-level security, security operations carried out locally in the EU, transparent and immediate incident reporting, and audits permitted EAL3-level security, with the full incident lifecycle handled in the EU and independent audit access EAL4–5, integration with ENISA information-sharing, and immutable EU-held logs auditable by any independent entity

Weakest link

On audit rights and incident handling — the two criteria the framework is strictest about — what is still true?

The provider retains full control of security logs, and breach reporting is ad hoc or absent Incidents may be escalated to non-EU teams, or independent entities cannot fully audit the provider EAL2 certification, the full incident lifecycle handled in the EU, NIS2-aligned reporting, and any independent entity may audit EAL3, customer-controlled EU-stored logs, and internal SLAs at or below regulatory maximums EAL4–5, ENISA information-sharing, and immutable EU-held logs

SOV-8 · Environmental Sustainability

Typical posture

How efficient, circular and transparently reported is the infrastructure?

Unknown — no measures, targets or reporting in place General claims only, with nothing measured and no targets A documented and transparent approach to energy efficiency, hardware lifecycle and emissions A documented circular-economy programme, with detailed reporting on an EU methodology EU-certified hardware lifecycle and independently EU-audited reporting

Weakest link

On the least-measured part of your environmental footprint, what is still true?

No hardware reuse or recycling policy, and nothing is reported PUE above 1.5 with no roadmap, or only high-level environmental claims PUE below 1.5 with a roadmap, a documented reuse programme, and annual reporting Detailed reporting on an EU methodology, with an EU-aligned circular-economy programme EU-certified hardware lifecycle and independently EU-audited reporting

Your result

Your sovereignty assurance level

Overall assurance level

SEAL-0

Your overall SEAL is the lowest level reached in any single objective — the framework's weakest-link rule. Lift your weakest area to raise it.

Capped by

— why?

0 / 100

EU Sovereignty Score

Independent of your level: the score averages every answer, the level takes the worst. A high score with a low level is normal — and the framework treats the level as decisive, using the score only to compare services that already meet a required level.

Unlock your full report

See your profile and how to improve it

Your level and score are above. Enter your email for the per-objective breakdown and a prioritised improvement plan — every criterion you can lift, what the next level requires, and what it is worth — plus the full report in your inbox.

Website

Nothing was sent anywhere while you answered — your responses stayed in your browser until now.

Unlocked — your full report is on its way to your inbox.

Profile

By objective

Where to improve, and how

Objectives are ordered by what will move your result most — weakest first. Each item shows the answer you gave, what the next level up requires, and what it is worth: assurance levels or score points.

Based on the European Commission's Cloud Sovereignty Framework (first presented Oct. 2025), its Implementation Guidance and the accompanying sovereignty assessment calculator. This self-assessment is for informational purposes only and is not a formal compliance determination.