EU Sovereignty Score shows how dependent your organisation is on technology outside European control. Every vendor gets the same five-part score, built on evidence you can follow.
Methodology
The scoring is based on five dimensions, each scored from 0 (high exposure) to 100 (sovereign):
JES · 20%SOV-2
Under which jurisdiction does the vendor fall? EU-based companies score high.
DRS · 20%SOV-3
Where is your data processed and stored? Hosting only in the EU or the EEA scores highest. Switzerland sits in between: not an EU member, but recognised by the EU as adequate (EU + Switzerland 90, Switzerland only 80, partly outside Europe 50, nothing in Europe 0).
CKS · 20%SOV-3
Who manages the encryption keys? Open-source and EU-managed keys score better.
PLS · 20%SOV-6
How easily can you switch? Open-source software lowers the lock-in risk.
SRS · 20%SOV-4 · SOV-6
Is the source code available and does the software run in the EU?
The total score is an equally weighted average of all dimensions. Context such as sector, data classification and criticality level will be included in future versions.
These five dimensions align with part of the European Commission's Cloud Sovereignty Framework (October 2025), which defines eight sovereignty objectives (SOV-1 to SOV-8) for formal procurement: JES corresponds to SOV-2 (Legal & Jurisdictional), DRS and CKS to SOV-3 (Data & AI), PLS to SOV-6 (Technology), and SRS to both SOV-4 (Operational) and SOV-6 (Technology).
We deliberately don't score four of the framework's objectives: SOV-1 (Strategic — ownership, financing and governance influence), SOV-5 (Supply Chain — origin of hardware, firmware and components), SOV-7 (Security & Compliance — certifications and formal GDPR, NIS2 and DORA adherence) and SOV-8 (Environmental Sustainability). Assessing those requires per-vendor evidence and a formal audit — different from the publicly verifiable facts this tool is built on.
Official sources: Cloud Sovereignty Framework (European Commission, October 2025) · Implementation guidance (European Commission, June 2026)
Vendors enter the knowledge base after we have checked public sources: headquarters and ultimate owner via the vendor's website and legal notice, press releases and annual reports, and in case of doubt the company register; hosting locations via the vendor's documentation; the licence via the source repository; and whether the product is still actively offered. Foreign ownership of a European company is recorded separately, because it affects jurisdictional certainty. The whole knowledge base was fully audited in June 2026 and checked for changes in September 2026; we repeat that check periodically.
Submissions from visitors and vendors never appear automatically. Every submission goes through the same check before it enters the knowledge base, and borderline cases follow our published provenance policy. That makes the knowledge base smaller than a directory where anyone can add themselves, but every score can be traced back to recorded facts and the published method.
Verification is free of charge and applies to every vendor. It is not a paid label: a vendor cannot pay for it and cannot buy it.
Provenance policy (ADR-001)Submit a vendor or suggest a correction
Every fact on a vendor page carries one of these four labels, so you can see at a glance how solid the evidence behind it is:
Vendors cannot pay for a better score or a better spot. There are no paid listings or positions, no paid labels, no affiliate links and no paid placements in vendor lists or alternative lists. The order of alternatives follows only the published scoring model and the provenance policy.
The tool is funded by reports and donations from users, the business data licence, and a limited number of self-sold sponsor banners on category pages. Accans, which runs the site, sponsors it in kind: hosting, domain names and development time. Category pages without a booked sponsor therefore show the Accans banner. A vendor — sponsor or not — cannot buy, improve or remove its listing; corrections are applied only after checking public sources. Sponsor banners are always labelled "Sponsored", carry no tracking or analytics and have no influence on score or ranking whatsoever.
Your assessment data never leaves your browser. All calculations are performed client-side. The optional telemetry collects only aggregated, anonymised counters — no personal data, no raw scores, no IP addresses. Telemetry is on by default (opt-out) and can be switched off with one toggle in the footer; that choice is remembered in your browser. If you paste an application list, names the knowledge base does not know are counted under the same toggle (the name only, no IP or session) so the knowledge base can grow.
Digital sovereignty is the degree to which an organisation retains control over its data, software choices and operational continuity. Concretely: does your data sit under EU jurisdiction, can you manage your own encryption keys, and can you switch vendors without prohibitive cost? The more 'yes' answers to those questions, the more sovereign you are.
Each selected vendor is scored across five dimensions (JES, DRS, CKS, PLS, SRS) from 0 (high exposure) to 100 (sovereign). The total is an equally weighted average. Future versions will also factor in context like sector, data classification and criticality.
No personal data. The assessment runs entirely in your browser; calculations never leave your device. You can optionally share anonymous, aggregated counters for the community trends — telemetry is on by default (opt-out) and can be switched off in the footer. No IP addresses, no session IDs, no cookies beyond your language preference.
JES = Jurisdiction (where the vendor is incorporated). DRS = Data residency (where your data is actually hosted). CKS = Cryptographic key sovereignty (who controls the encryption keys). PLS = Freedom from lock-in (how easily you can switch). SRS = Source & runtime sovereignty (source code availability and runtime location). Each dimension measures a different risk facet.
A vendor whose headquarters is in an EU country and that offers the option to host data inside the EU. We also distinguish between product (software you deploy or consume) and service (consultancy, MSSP, training). Products are only ever recommended as replacements for other products — an MSSP is never suggested in place of a SaaS product, and vice versa.
No. The EU Sovereignty Score is an exploratory instrument for surfacing risks; it is not legal advice and not a compliance attestation for GDPR, NIS2, DORA or similar regulation. Use it to start conversations, identify gaps and set priorities — leave the legal evaluation to your own counsel.
Ric van Westhreenen, a hands-on interim manager specialising in IAM, digital transformation, governance and compliance. With experience at organisations such as Ahold Delhaize, T-Mobile, Vattenfall and EP NL, and as a supervisory board member at TYPO3 GmbH.
The vendor catalogue currently lists 6,880 vendors and is updated periodically based on market developments, user feedback and new EU entrants. The most recent changes are always visible on the changelog page.
No. All product and company names on this site — Microsoft, Google, AWS, Salesforce, Slack and every other vendor referenced — are trademarks™ or registered® trademarks of their respective holders. Mention on this site does not imply affiliation, sponsorship or endorsement. This tool is an independent information resource, produced without any commercial relationship with any party referenced. No rights can be derived from the classifications shown; for formal legal or compliance assessments, please consult your own counsel.
This tool was developed by Ric van Westhreenen — a hands-on interim manager specialising in IAM, digital transformation, governance and compliance. With experience at organisations such as Ahold Delhaize, T-Mobile, Vattenfall and EP NL, and as a supervisory board member at TYPO3 GmbH, he combines strategic insight with pragmatic execution.