Ownership / ultimate parent (EU-owned?)

Why important?

Ownership/jurisdiction affects access obligations (e.g., CLOUD Act), governance and audit risk assumptions.

How measured?

• 0 = Ultimate parent clearly non-EU (no EU governance/separation)
• 1 = Non-EU ultimate parent (EU entity only operational/contracting)
• 2 = Non-EU parent, but stronger EU structures (e.g., EU subsidiary, limited governance)
• 3 = EU operations/governance mechanisms exist, ultimate parent remains non-EU
• 4 = EU-owned, but relevant non-EU influence/control topics (e.g., investors/structure)
• 5 = Ultimate parent EU-owned (control in the EU)
• N/A = no reliable evidence

Sources / Evidence

• https://www.aboutamazon.eu/news/aws/built-operated-controlled-and-secured-in-europe-aws-unveils-new-sovereign-controls-and-governance-structure-for-the-aws-european-sovereign-cloud
• https://www.ionos.com/new-brand
• https://www.stackit.de/en/newsarticle/stackit-independent-company/
• https://corporate.ovhcloud.com/en/
• https://www.open-telekom-cloud.com/en/benefits/sovereignty
• https://www.oracle.com/europe/cloud/eu-sovereign-cloud/faq/
• https://www.prnewswire.com/news-releases/godaddy-inc-announces-sale-of-plusserver-300489582.html
• https://www.exoscale.com/datacenters/
• https://www.hetzner.com/de/european-cloud/
• https://www.scaleway.com/en/about-us/
• https://news.microsoft.com/de-de/erste-souveraene-cloud-plattform-fuer-die-deutsche-verwaltung-auf-der-zielgeraden/
• https://www.deloscloud.de/about-us.html
• https://www.noris.de/en/company/about-us/
• https://www.secunet.com/en/about-us/press/article/secunet-security-networks-ag-uebernimmt-syseleven-gmbh
• https://learn.microsoft.com/de-de/industry/sovereign-cloud/overview/microsoft-sovereign-cloud

Validation questions (RFP)

• Who is the ultimate parent? Which corporate/jurisdictional chain applies for disclosure obligations?

Scores comparison