Customer-created metadata in the EU

Why important?

Metadata can be sensitive (e.g. resource names, tags).

How measured?

• 0 = Metadata/telemetry/billing clearly outside the EU
• 1 = EU residency only claimed, categories (logs/tags/billing) unclear
• 2 = Some metadata in the EU, but key categories outside/unclear
• 3 = Most metadata in the EU, but important categories (e.g. billing/control plane) unclear
• 4 = Metadata residency broadly documented (logs/tags/billing) with few exceptions
• 5 = Metadata/logs/telemetry/billing EU-only + backed contractually/verifiably
• N/A = no reliable evidence

Sources / Evidence

• https://www.aboutamazon.eu/news/aws/built-operated-controlled-and-secured-in-europe-aws-unveils-new-sovereign-controls-and-governance-structure-for-the-aws-european-sovereign-cloud
• https://www.aboutamazon.fr/actualites/aws/7-8-milliards-euros-investis-par-aws-dans-le-cloud-souverain-europeen
• https://aws.eu/de/
• https://news.microsoft.com/de-de/erste-souveraene-cloud-plattform-fuer-die-deutsche-verwaltung-auf-der-zielgeraden/

Validation questions (RFP)

• Which metadata (control plane, billing, support tickets) may leave the EU? Is audit evidence available?

Scores comparison