Hardware Origin & Chip Supply-Chain Dependency
Why important?
Supply-chain sovereignty (SOV-5, the highest CSF weighting) determines resilience against third-country influence at hardware level.
How measured?
Scale 0–5 + N/A:
- 0 = No information on hardware/chip origin; complete, opaque dependency on non-EU suppliers.
- 1 = Hardware non-EU, but documented; no diversification or resilience measures.
- 2 = Partial supply-chain transparency; individual EU components or second sources.
- 3 = Documented, diversified supply chain; EU assembly/integration; resilience against individual non-EU failures.
- 4 = High EU supply-chain depth incl. EU manufacturing where available; demonstrated resilience.
- 5 = Largely EU-sovereign supply chain "from chips to software" (towards SEAL-4) + verifiable evidence.
- N/A = no reliable evidence
Sources / Evidence
Validation questions (RFP)
- Which manufacturers supply servers, CPUs, GPUs and network components, and where are they manufactured and assembled? How are firmware integrity and the supply chain verified (e.g. secure boot, hardware attestation)? Is there a documented plan for the loss or sanctioning of a single manufacturer?
Scores comparison
| Provider | Score | |
|---|---|---|
| OVHcloud Public Cloud (inkl. SecNumCloud) | 3.0 | Vertical integration: OVHcloud designs and manufactures its own servers in its own plants (FR: Croix/Roubaix; also Canada) and controls the supply chain from sheet metal to server. Chips (Intel/AMD) remain non-EU. (stated) |
| AWS European Sovereign Cloud | 2.0 | Custom silicon (Nitro/Graviton, Annapurna Labs) developed outside the EU, manufactured globally (TSMC); no EU chip/fab depth; supply chain documented, but non-EU. (stated) |
| STACKIT | 2.0 | Own data centres in DE/AT; standard x86 (Intel/AMD), no EU fab; supply chain depth not stated. (verify) |
| Oracle EU Sovereign Cloud | 2.0 | EU sovereign realm operated in the EU, but global Oracle supply chain (x86/Ampere ARM); no EU chip depth. (stated) |
| Hetzner Cloud | 2.0 | In-house server assembly in DE (Hetzner builds its own servers); standard x86 (Intel/AMD), no EU chip manufacturing. |
| Scaleway | 2.0 | EU operations, own data centres (FR); vertical hardware manufacturing currently not prominently documented. (verify) |
| Infomaniak Public Cloud | 2.0 | According to the provider, European components are preferred; chips remain non-EU; no EU fab. (stated) |
| IONOS Cloud | 1.0 | No public documentation on hardware/chip origin or EU supply chain depth. (verify) |
| T Cloud Public | 1.0 | Known Huawei hardware dependency in the supply chain (non-EU/China); mitigated by EU-only operations, hardware origin remains non-EU. (stated) |
| pluscloud open | 1.0 | No documentation on hardware or chip provenance. (verify) |
| UpCloud | 1.0 | No documentation on hardware or chip provenance. (verify) |
| Exoscale | 1.0 | No documentation on hardware or chip provenance. (verify) |
| Delos Cloud | 1.0 | Azure hardware (Microsoft supply chain, global/non-EU). (stated) |
| Microsoft Sovereign Cloud | 1.0 | Global Microsoft supply chain/hardware (non-EU); no EU chip depth. (stated) |
| noris Sovereign Cloud | 1.0 | No public documentation on hardware/chip origin (own high-security data centres in DE). (not evidenced) |
| SysEleven OpenStack Cloud | 1.0 | No public documentation on hardware/chip origin (secunet group). (not evidenced) |
| Cloud Temple Trusted Cloud | 1.0 | No public documentation on hardware/chip origin (VMware/Stormshield stack). (not evidenced) |