Cloud Sovereignty Framework
European Digital Sovereignty

• Decision-making bodies, financing, value creation in EU jurisdiction
• Protection against "Change of Control" by non-EU entities
• Continued operation despite external pressure: design and enforcement capability beyond contracts

• EU law as governing jurisdiction, EU court venue
• Shielding against CLOUD Act, FISA & Co.
• No legal, contractual or technical channels for third-country access

• Customer key sovereignty (BYOK/HSM), complete access logs
• Strict EU data localization without fallbacks
• EU control over models, pipelines and platforms; verifiable deletion proofs

• Exit and migration capability without lock-in
• EU-based skills, support and operations
• Complete technical documentation and source transparency; control of critical subcontractors

• Transparency on hardware origin, firmware, embedded code
• Software origin, packaging and updates under EU control
• SBOM transparency and audit rights along the chain

• Standardized, non-proprietary APIs/protocols
• Open source accessibility (audit, modification, redistribution)
• Transparency on architecture, data flows, dependencies; minimal lock-in

• Relevant EU certifications (ISO, ENISA), GDPR/NIS2/DORA
• SOC/IR teams in the EU; customer access to logs/alerts
• EU-compliant incident reports, patch autonomy, independent audits

• High energy efficiency (PUE), circular economy
• Transparent emissions and water metrics; high renewable energy share
• Long-term operational capability under climate considerations

• Decision bodies: Headquarters/control in the EU
• Change of Control: Protection against non-EU takeover
• Financing: EU capital, no critical non-EU investors
• Value creation: Jobs, development, operations in the EU
• EU priorities: Contribution to digital goals
• Continuity: Continued operation under external pressure

• Legal system: EU law governing
• Extraterritorial access: Shielding (CLOUD Act, FISA etc.)
• Access channels: No non-EU channels
• Export control: EU-compliant
• IP jurisdiction: EU law
• Court venue: EU courts

• Customer key sovereignty: BYOK/BYOHSM, no escrow
• Data access audit: Complete, reliable logs
• EU data localization: Without fallbacks
• AI transparency: Auditable models/pipelines
• Deletion proof: Cryptographic, verifiable

• Exit capability: Standardized runbooks, complete exports
• EU skills: Support/operations by EU teams
• Documentation: Architecture, runbooks, IaC
• Source transparency: Open or full source access
• Subcontractors: EU-based, documented, auditable

• Hardware origin: Manufacturing/firmware/embedded code documented
• Software SBOM: Complete, signed
• Update jurisdiction: Patches/updates under EU control
• Non-EU dependencies: Minimized, with alternatives
• Audit rights: Contractually assured

• Open standards: Non-proprietary APIs/protocols
• Open Source: Audit/modification/redistribution
• Architecture transparency: Data flows/dependencies
• Portability: Minimal lock-in
• HPC independence: EU control over critical resources

• EU certifications: ISO 27001, ENISA schemes, national standards
• Regulation: GDPR, NIS2, DORA
• EU SOC/IR: Teams in the EU
• Log control: Direct customer access
• Incident reporting: EU-compliant
• Patch autonomy: Independent updates

• Energy efficiency: PUE, DC optimization
• Renewable energy: Certificates/share
• Circular economy: Recycling/reuse
• Transparency: CO₂/water/energy public
• Long-term: Scenarios under climate change

• Services fully controlled by non-EU actors
• No effective EU jurisdiction or enforceability

• EU law applies formally
• Effectively limited by substantial non-EU control over operations, technology or governance

• EU law applies and is enforceable
• Material non-EU dependencies remain
• Indirect control by non-EU actors possible

• EU law applies and is enforceable
• EU actors have substantial but not complete influence rights
• Only marginal non-EU control

• No critical non-EU dependencies
• Technology, operations, governance and supply chain under complete control of EU actors in EU jurisdiction

European providers can directly monetize strengths in openness (standards, open source), EU-based operations, supply chain transparency and data sovereignty – as a measurable advantage in the award score.

Verifiable properties: EU-based operations/support/logging (SOV-7), BYOK/HSM and EU data localization (SOV-3), standardized, portable architectures (SOV-4/6), traceable supply chains (SOV-5), governance protection (SOV-1/2).

"Sovereignty labels" without substantial technical or organizational shielding will likely achieve at most SEAL-2 in the framework – formal jurisdiction, but material dependencies.

• No provider escrow, no recovery backdoors
• Cryptographic erasure with verifiable proofs
• On-premise HSM integration for highest requirements

• Complete export: container images, Helm charts, IaC code, secrets (encrypted), configurations, databases, object storage
• Porting to other Kubernetes providers in <48h
• SCS compatibility for maximum portability

• Architecture diagrams, data flow schemas, dependency maps
• Runbooks, IaC code, disaster recovery plans
• Publicly accessible (open source) or fully transferable to customers
• No "black boxes"

• All platform components with version numbers, licenses, signatures
• Transparent update processes, chain of trust
• Automated security scanning
• Sub-supplier register with jurisdiction and audit rights

• All data (runtime, backups, logs, metrics) remains in EU data centers
• No non-EU admin access
• Policy-based protection through automated compliance enforcement

• Incident response by EU teams, no offshore escalation to non-EU entities
• Direct customer access to logs, metrics and alerts
• Complete observability platform
• 24/7 from EU locations

• Management, decision-making bodies and financing in Germany
• No non-EU dependencies in governance or ownership structure
• 100% EU value creation

• All contracts subject to German law
• No extraterritorial access obligations
• GDPR compliance by design
• Clear legal enforceability

• Strict EU data localization (Germany)
• Customer key sovereignty through BYOK/BYOHSM without provider access
• No non-EU data transfers
• Full transparency on data flows and AI usage

• Open source stack based on Kubernetes
• Complete documentation at docs.ayedo.de
• EU-based support and operations
• No proprietary lock-ins

• EU data centers with highest certifications
• Open source software stack with automated security scanning
• SBOM transparency with complete artifact management

• Kubernetes-native stack, standardized APIs (K8s API)
• Full auditability
• No proprietary dependencies
• Open source community participation

• ISO 27001, TISAX in preparation
• SOC/IR teams in Germany
• Direct customer access to logging and monitoring
• GDPR/NIS2 compliant
• Regular security audits

• Partner DCs with 100% renewable energy, PUE < 1.3, climate neutral
• Transparent energy and emissions metrics
• Long-term resource resilience

• ayedo is designed to achieve SEAL-4 (Full Digital Sovereignty) across all eight sovereignty objectives
• Without compromises, without sovereign-washing

NIS-2 requires BCP/DR and supply chain management for critical infrastructures. The framework evaluates independence and control – directly relevant for NIS-2 supply chain risks and resilience of critical infrastructures. EU-based, sovereign stacks reduce jurisdictional and concentration risks.

More about NIS-2

DORA requires ICT third-party risk management including exit capability. The framework evaluates exit capability, control and independence – factors that directly address DORA third-party risks. EU-based, sovereign ICT stacks reduce jurisdictional and concentration risks.

More about DORA

CRA requires security across product lifecycle (Security by Design, SBOM, vulnerability management). The framework evaluates technology sovereignty (SOV-6): open standards, open source, transparency. Together: secure EU products with open standards, transparency, exit capability – without lock-in.

More about CRA

The Data Act requires technical/contractual measures against vendor lock-in – directly relevant for framework evaluation of operational sovereignty (SOV-4). Interoperability and standardized interfaces become the regulatory standard. Open standards, exit strategies = maximum control.

More about Data Act

GDPR requires data protection, security (Art. 32), protection for third-country transfers (Chapter V). The framework evaluates data/AI sovereignty (SOV-3): EU data localization, customer key sovereignty, exit capability. EU-only stacks with BYOK = GDPR-native.

More about GDPR

CIGREF Trusted Cloud (France) as reference model for trusted cloud services. Gaia-X as European data infrastructure initiative. The EU framework builds on CIGREF principles, adopts Gaia-X principles on transparency, portability, interoperability and makes them procurement-relevant with operationalizable evaluation criteria and SEAL levels.

"Cloud de Confiance" (France), "Sovereign Cloud" (Germany), national strategies in NL/BE/IT. The framework harmonizes national approaches into a unified EU-wide evaluation matrix – for cross-border procurement. SEAL levels as common currency.

How ayedo systematically addresses Cloud Sovereignty Framework, NIS-2, DORA, CRA, Data Act, GDPR, ISO 27001 and other standards. Certifications, processes, technical measures and audit readiness – find our complete compliance roadmap here.

To overview

We help you apply the eight sovereignty objectives to your organization, define SEAL minimum levels and weight award criteria.

Our Managed Kubernetes Platform fulfills the framework requirements out-of-the-box – with complete transparency and control.

Already using other cloud providers? We support you with vendor-independent migrations – without lock-in, with complete exit capability.