Sovereignty scan
The Sovereignty Scan is an assessment in which we systematically map where an organisation's data and systems are located, which suppliers and underlying parties are involved, and under which legal framework that data falls.
Why the Sovereignty Scan?
The Sovereignty Scan is an assessment in which we systematically map where an organisation's data and systems are located, which suppliers and underlying parties are involved, and under which legal framework that data falls. Think of exposure to legislation such as the US CLOUD Act, alongside the applicable frameworks within the EU and the GDPR.
The scan is particularly relevant for organisations in sectors with heightened sensitivity: government, healthcare, financial services and critical infrastructure, where regulation or internal risk assessment explicitly calls for control over digital sovereignty.
Our approach
- 1
Leveranciers en dataverwerkers in kaart brengen
We identify which cloud platforms, suppliers and subcontractors are involved in processing and storing your data, including the chain of underlying processors (sub-processors).
- 2
Juridische blootstelling beoordelen
We assess which jurisdictions the parties involved fall under, with specific attention to exposure to non-European legislation such as the US CLOUD Act.
- 3
Datalocaties en -stromen analyseren
We map where data is actually stored and processed, including any data movement between regions that is not always visible in standard documentation.
- 4
Risico's en alternatieven benoemen
We link the findings to concrete risks for your organisation and, where relevant, map out alternatives such as European platforms like Scaleway or StackIT.
- 5
Rapportage en advies
The scan results in a clear report with findings, risk classification and concrete advice, suitable for sharing with regulators, the board or compliance officers.
What does the Sovereignty Scan deliver?
Full overview
Complete visibility into where your data and systems are located and which suppliers and sub-processors are involved.
Legal clarity
Clarity on which jurisdiction your data falls under, including exposure to legislation such as the US CLOUD Act.
Substantiated risk assessment
Concrete risk classification per domain, so you can make well-founded choices about platforms and suppliers.
Actionable reporting
A report suitable for sharing with regulators, the board or compliance officers.
Data
Curious how we can help your organisation in the area of Data?
Ready to gain insight into your digital sovereignty?
Digital Survival Company carries out Sovereignty Scans for organisations in government, healthcare, financial services and critical infrastructure, with experience in both major cloud platforms and European alternatives such as Scaleway and StackIT. Get in touch and we'll discuss together what the Sovereignty Scan can deliver for your organisation.
FAQ
For which organisations is the Sovereignty Scan particularly relevant?
The scan is particularly valuable for organisations in government, healthcare, financial services and critical infrastructure, where regulation or risk policy explicitly calls for control over where data resides and which law it falls under. Organisations that are consciously considering their dependence on non-European suppliers also benefit from the scan.
Does a low sovereignty score mean we need to switch platforms immediately?
Not necessarily. The scan provides insight, not an obligation. For many organisations, the outcome is a conscious trade-off between functionality, cost and sovereignty. Where relevant, we advise on alternatives, but the decision to actually switch platforms lies with your organisation.
How does the Sovereignty Scan relate to the BIO/NIS2 compliance scan?
The scans overlap but have a different focus. The Sovereignty Scan focuses on where data resides and which law it falls under. The BIO/NIS2 compliance scan assesses whether information security meets specific legal frameworks. For organisations dealing with both issues, we combine the scans where that is efficient.