A short self-check that shows how much control your organisation keeps over a cloud service: who controls the provider, whose laws apply, where your data sits and whether you could switch.

• It has 8 areas and 48 questions.
• Each answer earns a score.
• You get a report with an overall score, a rating and the areas to fix first.
• It is fully built for the EU. UAE, India and Saudi Arabia are still in development.

SEAL is a rating from 0 to 4 that shows how sovereign a cloud service is. Higher is better. SEAL stands for Sovereignty Effectiveness Assurance Level.

• SEAL-4: Full Digital Sovereignty. Low risk.
• SEAL-3: Technological Sovereignty. Moderate risk.
• SEAL-2: Data Sovereignty. Elevated risk.
• SEAL-0 or SEAL-1: No Sovereignty. High risk.
• Your overall level is set by your weakest answer, not an average.

Mostly EU rules and certifications that show a provider can be trusted.

• GDPR: protects personal data.
• NIS2: sets cybersecurity and incident-reporting duties.
• DORA: resilience rules for financial firms.
• EUCS: the EU cloud security certification, at Basic, Substantial and High levels.
• ISO/IEC 27001 and SOC 2: common security audits.
• Energy and carbon standards (such as PUE and CSRD) cover sustainability.

Each of the 8 areas gets a percentage. They are combined into one overall score and the more important areas count for more.

• How much each area counts: Strategic control 20%; Operations 15%; Technology 15%; Security and compliance 15%; Legal and jurisdiction 10%; Data and AI 10%; Supply chain 10%; Sustainability 5%.
• Any area below 60% is flagged as a risk (shown red). 60% or more is shown green.
• The report lists up to five questions to fix first.

Staying in control of your cloud: who runs the provider, which country's laws apply, where your data and encryption keys are and whether you can move away.

• Laws: a foreign law can force a provider to hand over data, even when the data is stored in your region.
• Data and keys: whoever holds the encryption keys decides who can read the data.
• Lock-in: being so dependent on one vendor that leaving is costly.
• EU/EEA: the European Union plus Iceland, Liechtenstein and Norway.