| SOV-1 Strategic Sovereignty | SEAL-1 | |
| SOV-2 Legal & Jurisdictional Sovereignty | SEAL-1 | |
| SOV-3 Data & AI Sovereignty | SEAL-1 | |
| SOV-4 Operational Sovereignty | SEAL-3 | |
| SOV-5 Supply Chain Sovereignty | SEAL-1 | |
| SOV-6 Technology Sovereignty | SEAL-3 | |
| SOV-7 Security & Compliance Sovereignty | SEAL-1 | |
| SOV-8 Environmental Sustainability | SEAL-2 |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-1.1 | EU/EEA legal entity control | 2. Mostly outside the EU | 42/125 | SEAL-1 | high | eu_entity FALSE: primary entity Akenes SA is incorporated in Lausanne, Switzerland (third country, not EU/EEA); intermediate owner A1 Digital is Austrian (EU) but the operating entity sits outside the EU -> mostly outside EU, opt2 (seal 1). (src: https://www.exoscale.com/about-us/) |
| SOV-1.2 | Change of control risk | 2. Likely takeover/transfer to non-EU sovereign entity | 31/125 | SEAL-4 | medium | Ultimate parent Telekom Austria is controlled (56.55%) by Mexico's America Movil, a non-EU sovereign-market entity; Exoscale has already changed hands once (2017). Further transfer of this asset to a non-EU controller is plausible given the ownership chain. |
| SOV-1.3 | Control over roadmap | 2. Through 'voice of the customer' public channels | 42/125 | SEAL-2 | low | Roadmap set by Exoscale/A1 management; EU-actor influence limited to customer feedback/changelog channels, no formal EU governance body -> opt2 (seal 2). |
| SOV-1.4 | Financial independence from non-EU capital | 3. Balanced mix of EU and non-EU funding | 63/125 | SEAL-4 | medium | Funding/capital comes through A1 Telekom Austria Group, which mixes EU (ABAG, Austrian state, ~28%) with significant non-EU control (America Movil, Mexico, ~57%), giving a balanced-to-mixed EU/non-EU capital base. |
| SOV-1.5 | EU economic contribution | 4. Majority in the EU | 94/125 | SEAL-4 | medium | Operations, employment, data centres and revenue are concentrated in Europe (CH, AT, DE, BG, HR), so the majority of economic contribution is in/around the EU, though HQ and some value sit in Switzerland. |
| SOV-1.6 | Participation in EU strategic programs | 3. Active participant in strategic projects | 63/125 | SEAL-4 | high | Active participant: Gaia-X day-one member (via A1) contributing to working groups, and selected on the GEANT OCRE 2024 framework for European research and education procurement. |
| SOV-1.7 | Alignment with EU industrial strategies | 2. Existing action plan | 42/125 | SEAL-4 | low | Public positioning and marketing align with EU digital-sovereignty goals (European alternative to US hyperscalers) and there is an action plan, but no measured achievement or dedicated sovereignty governance is evidenced. |
| SOV-1.8 | Resilience to cut-off | 4. Ability to source alternatives or internalise key functions | 94/125 | SEAL-2 | low | own_stack partial: runs its own platform on leased EU/CH colocation and could source alternatives/internalise, but a real non-EU operational dependency remains (Swiss base, foreign hardware) -> opt4 'source alternatives/internalise' (seal 2), not full autonomy. |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-2.1 | Primary legal jurisdiction | 2. Mixed EU/non-EU | 84/167 | SEAL-1 | high | Contracts governed by Swiss law (canton Vaud), a third-country jurisdiction; EU zones (Vienna AT, Frankfurt/Munich DE, Sofia BG) bring GDPR/member-state law into play -> mixed EU/non-EU, not exclusively EU, opt2 (seal 1). (src: https://www.exoscale.com/terms/) |
| SOV-2.2 | Extraterritorial laws exposure | 4. Legal structures shielding from foreign law | 125/167 | SEAL-2 | medium | immunity FALSE (no SecNumCloud/EUCS-High; Swiss entity with non-EU Mexican ultimate parent). Swiss incorporation does place it outside the US CLOUD Act/FISA/PRC, giving legal structures shielding from foreign law -> opt4 (seal 2), but not verified immunity. (src: https://www.exoscale.com/about-us/) |
| SOV-2.3 | Data access pathways for non-EU authorities | 4. Requests disputed, sometimes accepted with notification | 125/167 | SEAL-1 | medium | foreign_parent TRUE: ultimate control via A1 Telekom Austria is majority-held by America Movil (Mexico, ~51-58%), a non-EU parent reachable by foreign law. It is genuinely exempt from US CLOUD Act/FISA/PRC (no US/PRC nexus) and disputes/refuses requests, but the non-EU ownership chain blocks the absolute opt5 'always rejected' -> opt4 'requests disputed' (seal 1). DECISIVE SEAL-1 gate. Distinct from the pure-Swiss-no-foreign-parent peers (Infomaniak/Safe-Swiss/Nine = opt5): Exoscale has a non-EU ultimate parent. (src: https://ventures.swisscom.com/a1-digital-acquires-swiss-cloud-provider-exoscale/) |
| SOV-2.4 | Export control restrictions | 3. Share of revenues >50% in the EU | 84/167 | SEAL-2 | low | >50% revenue in the EU/European market and no known export-control restrictions toward EU MS, but no part of the offer is formally shielded from restrictions -> opt3 (seal 2). |
| SOV-2.5 | Origin of IP | 4. Mostly within the EU | 125/167 | SEAL-4 | medium | Core platform IP is developed by Exoscale's European (Lausanne-based) engineering teams, with upstream open-source dependencies; IP is mostly within the EU/EEA-adjacent European sphere. |
| SOV-2.6 | IP holder jurisdiction | 3. Mixed law, some EU | 84/167 | SEAL-3 | medium | IP held by Akenes SA under Swiss (non-EU) law, but with EU-based intermediate ownership and EU operations -> mixed law, some EU, opt3 (seal 3). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-3.1 | Customer control over encryption keys | 4. Customer primary control but provider can read data | 150/200 | SEAL-3 | medium | Customer BYOK encryption supported, but as IaaS the provider technically retains access to unencrypted data unless the customer encrypts client-side -> customer primary control, provider retains capability, opt4 (seal 3). |
| SOV-3.2 | Transparent data flows & access logs | 4. Full customer-controlled visibility, not real-time | 150/200 | SEAL-3 | medium | Customers get audit logs, IAM and activity visibility through the portal/API, giving full customer-controlled visibility, though not advertised as real-time independently auditable streaming. |
| SOV-3.3 | Secure deletion & proof of erasure | 3. Internal validation per policy, no proof | 100/200 | SEAL-1 | low | Deletion is handled per documented internal policy and shared-responsibility model under ISO 27001 controls, but no independent cryptographic proof-of-erasure certificate is offered. |
| SOV-3.4 | Data location strictly in EU/EEA | 4. EU by default, tightly controlled exceptions | 150/200 | SEAL-1 | high | eu_exclusive FALSE: data stays in the customer-selected zone with no automatic fallback, but the default footprint includes Switzerland (a third country) alongside EU member-state zones AT/DE/BG/HR -> EU-by-default w/ tightly controlled non-EU exceptions, opt4 (seal 1). Not exclusively EU/EEA. Real EU-DC footprint (multiple EU member-state zones) distinguishes it from Swiss-only peers (Infomaniak/Safe-Swiss/Nine = opt2 seal 0). (src: https://community.exoscale.com/platform/dc-zones/) |
| SOV-3.5 | AI services sovereignty | 3. Mixed: auditable/open-source AI, foreign chips | 100/200 | SEAL-2 | low | GPU offering relies on foreign accelerator chips (Nvidia) running open/auditable model stacks rather than EU-origin silicon or black-box models -> mixed, opt3 (seal 2). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-4.1 | Portability & interoperability | 4. Formal migration services available | 125/167 | SEAL-4 | high | Open standards-based API, CLI, Terraform/Pulumi support, CNCF-certified Kubernetes (SKS) and documented data export enable formal portability and migration with low lock-in. |
| SOV-4.2 | Ability to operate without foreign dependencies | 4. Ops predominantly EU-based teams | 125/167 | SEAL-3 | medium | eu_ops: engineering and platform ops run by Exoscale's European (Swiss/EU) teams, predominantly EU-based staff with limited non-EU dependency beyond hardware -> opt4 (seal 3). |
| SOV-4.3 | Skill availability in the EU | 3. Majority EU, escalation abroad | 84/167 | SEAL-3 | low | eu_ops: staff concentrated in Europe (Lausanne HQ, A1 Group), majority EU/European with escalation kept in Europe; no EU-citizen-only staffing or clearances -> opt3 majority EU (seal 3). |
| SOV-4.4 | Support channels | 3. Majority in EU, non-EU escalations | 84/167 | SEAL-3 | low | eu_ops: support delivered by European-based customer-success engineers, majority in Europe with non-EU escalations possible; no EU-only staffing with clearances -> opt3 (seal 3). |
| SOV-4.5 | Documentation & knowledge transfer | 3. EU primary with non-EU fallback | 84/167 | SEAL-4 | low | Documentation/knowledge live primarily in European-managed repositories and community docs with European teams -> EU-primary with possible non-EU fallback, opt3 (seal 4). |
| SOV-4.6 | Subcontractor & supplier jurisdiction | 4. Ability to source alternatives or internalise | 125/167 | SEAL-3 | low | Critical subcontractors are EU/European colocation operators (e.g. Equinix); provider could source alternatives or internalise if a supplier withdrew -> opt4 (seal 3). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-5.1 | Origin of components (physical parts) | 2. Partial disclosure | 36/143 | SEAL-1 | low | As an IaaS operator on colocated infrastructure, only partial disclosure of physical component provenance; server hardware origin not publicly detailed -> opt2 (seal 1). |
| SOV-5.2 | Manufacturing location | 2. Foreign origin, partial disclosure | 36/143 | SEAL-1 | low | Underlying server/network hardware is foreign-manufactured (global OEMs) with at best partial disclosure; not built or designed by EU teams -> opt2 (seal 1). |
| SOV-5.3 | Embedded code/firmware provenance | 2. Partial disclosure | 36/143 | SEAL-4 | low | Firmware/embedded code in commodity servers and network gear is from foreign vendors with only partial disclosure; no EU-certified provenance. |
| SOV-5.4 | Origin of software | 4. Large majority maintained by EU teams | 107/143 | SEAL-3 | medium | foreign_core FALSE: the Exoscale platform software is designed and maintained by its own European engineering teams atop open source; does NOT run Google/MS/AWS under the hood -> large majority EU-maintained, opt4 (seal 3). No foreign_core cap. |
| SOV-5.5 | Software build/release jurisdiction | 4. EU control & execution | 107/143 | SEAL-3 | medium | Software build/release controlled and executed by Exoscale's European engineering org; no evidence of formal EU policy gates beyond standard controls -> EU control & execution, opt4 (seal 3). |
| SOV-5.6 | Single point of dependency | 3. Few non-EU in critical services / documented | 72/143 | SEAL-2 | low | A few non-EU dependencies in critical services (foreign-made server/chip hardware, some global tooling), documented via the shared-responsibility/compliance model -> few non-EU critical, opt3 (seal 2). |
| SOV-5.7 | Supply chain transparency | 3. Critical suppliers auditable | 72/143 | SEAL-2 | low | Critical suppliers (colocation/DC operators) are auditable and covered in the compliance program, but full end-to-end supply-chain auditability is not claimed -> critical suppliers auditable, opt3 (seal 2). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-6.1 | Interoperability & open interfaces | 4. Standards-based and broadly compatible | 150/200 | SEAL-3 | high | Standards-based and broadly compatible: open REST API, S3-compatible object storage, CNCF-conformant Kubernetes, Terraform/Pulumi providers enabling broad interoperability. |
| SOV-6.2 | Open standards compliance | 4. Policy for most core services | 150/200 | SEAL-3 | medium | Open standards (S3 API, upstream Kubernetes, OpenAPI) are adopted across most core services as a deliberate policy of staying close to upstream open ecosystems. |
| SOV-6.3 | Open source availability | 3. Open source, centralised governance | 100/200 | SEAL-3 | medium | foreign_core FALSE: Exoscale builds on and contributes to open source and ships open clients/providers; core control-plane is proprietary with centralised governance -> open source, centralised governance, opt3 (seal 3). No foreign_core cap. |
| SOV-6.4 | Service architecture transparency | 3. Some public insight | 100/200 | SEAL-3 | low | Substantial public insight via community docs, API specs, engineering blog posts and a published shared-responsibility model -> some public insight, opt3 (seal 3). |
| SOV-6.5 | HPC sovereignty | 2. EU-hosted, foreign stack | 50/200 | SEAL-3 | low | Any HPC/GPU capability is EU/CH-hosted but runs on a foreign hardware/software stack (Nvidia, standard stack); no EU-designed silicon -> EU-hosted foreign stack, opt2 (seal 3). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-7.1 | Security certification (EAL) | 4. EAL3 | 107/143 | SEAL-3 | medium | certs: BSI C5 + ISO 27001:2022/27017/27018 + SOC 2 Type II + TISAX + CSA STAR. Per key, BSI C5 is a high-assurance national cloud certification mapping to EAL3 -> opt4 (seal 3). C5 confirmed on Exoscale's own compliance page. (src: https://www.exoscale.com/compliance/) |
| SOV-7.2 | EU regulatory compliance (GDPR/NIS2/DORA) | 4. Partial compliance to most | 107/143 | SEAL-4 | high | Demonstrated GDPR and Swiss FADP compliance with a DPA, ISO 27001:2022, 27017/27018, SOC 2, TISAX and mappings to NIS2/DORA-relevant controls; partial-to-strong compliance across the EU regulatory set, though not a single all-encompassing independently audited attestation to every regime. |
| SOV-7.3 | EU-based SOC & incident handling | 4. Entire lifecycle by EU teams, EU threat intel | 107/143 | SEAL-3 | low | Security operations and incident handling run by Exoscale's European teams with European threat context; no formal ENISA/CSIRT sharing membership -> entire lifecycle by EU teams, opt4 (seal 3). |
| SOV-7.4 | Control over security monitoring/logging | 4. Full direct access, logs stored in EU | 107/143 | SEAL-3 | low | Customers have direct access to monitoring and audit logs via portal/API, logs stored in EU/CH zones; not advertised as immutable tamper-proof -> full direct access, logs stored in EU, opt4 (seal 3). |
| SOV-7.5 | Disclosure of incidents | 4. Partial compliance, monitored flow, SLAs | 107/143 | SEAL-3 | medium | Incident disclosure follows GDPR/NIS2-aligned obligations with monitored notification flows and contractual SLAs, no real-time CSIRT sharing -> partial compliance, monitored flow, SLAs, opt4 (seal 3). |
| SOV-7.6 | Maintenance autonomy | 3. Moderate autonomy (notice + testing, except zero-day) | 72/143 | SEAL-4 | low | Maintenance operated by Exoscale with customer notice/windows; customers retain moderate autonomy over their own workloads with testing, except emergency patching -> moderate autonomy, opt3 (seal 4). |
| SOV-7.7 | Auditability | 3. Partial independent control | 72/143 | SEAL-1 | low | audit_rights partial: independent audits performed by accredited certification bodies, compliance evidence shared under NDA; no contractual full audit by the contracting authority or any independent EU body -> partial independent control, opt3 (seal 1). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-8.1 | Energy efficiency (PUE) | 3. PUE < 1.5 + roadmap | 125/250 | SEAL-4 | low | Modern Equinix/partner facilities selected for efficiency, plausibly PUE <1.5 with improvement roadmaps; no specific verified figure published -> opt3 PUE<1.5+roadmap (seal 4). (src: https://www.exoscale.com/sustainability/) |
| SOV-8.2 | Hardware reuse & recycling | 3. Documented program | 125/250 | SEAL-3 | low | Hardware lifecycle/recycling addressed via a documented program within A1 Group ESG practices and partner DC operators, no EU-certified lifecycle claim -> documented program, opt3 (seal 3). |
| SOV-8.3 | Environmental impact reporting | 3. Annual report | 125/250 | SEAL-2 | medium | Since 2021 Exoscale contributes to A1 Group's annual ESG report (energy, waste, travel); structured annual reporting but no standalone EU-audited methodology -> annual report, opt3 (seal 2). |
| SOV-8.4 | Energy supplies | 4. Only EU energy supplies (high renewable) | 188/250 | SEAL-4 | high | Energy is European-sourced and predominantly renewable: 100% renewable in CH, DE and AT zones, 91% in Croatia and 75% in Bulgaria, with green energy certificates available; only-EU/European supplies with a high renewable share. (src: https://www.exoscale.com/sustainability/) |