EU Cloud Sovereignty Framework Assessment (SEAL)

Executive Summary

This document provides an assessment of StateWarden's architecture and operational model against the EU Cloud Sovereignty Framework (Version 1.2.1 - Oct. 2025). The assessment evaluates the 8 Sovereignty Objectives (SOV) and determines the Sovereignty Effectiveness Assurance Level (SEAL).

Assessment Basis: Self-Assessment - not an audited certification. This assessment was performed internally by the StateWarden team and has not been audited, verified, or certified by an independent body. The result is a per-objective assurance profile rather than a single overall level: most objectives are self-assessed at SEAL-4, SOV-5 (Supply Chain Sovereignty) at SEAL-3 to SEAL-4, and SOV-7 (Security & Compliance Sovereignty) at SEAL-3, primarily because ISO/IEC 27001 and ENISA certifications have not yet been obtained. StateWarden operates under EU control, subject to EU law, without non-EU strategic dependencies.

Detailed Assessment by Sovereignty Objective

SOV-1: Strategic Sovereignty (15%)

Strategic sovereignty captures the degree to which the services are anchored within the EU legal, financial, and industrial ecosystem.

• Assessment: SEAL-4
• Justification:
  • Control & Governance: The company and its governing authority are located entirely within the EU.
  • Investment & Value: The software is developed in Rust without reliance on non-EU strategic investments.
  • Autonomy: StateWarden's architecture (standalone Agent, Artemis, and Driad components) supports independent operation without external vendor support.

SOV-2: Legal & Jurisdictional Sovereignty (10%)

Evaluates the legal environment, exposure to foreign authority, and enforceability of rights.

• Assessment: SEAL-4
• Justification:
  • Jurisdiction: Operates under EU jurisdiction. Not subject to the US CLOUD Act or similar foreign cybersecurity laws.
  • Data Insulation: The platform is hosted on OVHcloud bare-metal infrastructure in EU data centers. No public cloud APIs are utilized.
  • Intellectual Property: Intellectual property is registered and managed within the EU.

SOV-3: Data & AI Sovereignty (10%)

Focuses on the protection, control, and independence of data assets.

• Assessment: SEAL-4
• Justification:
  • Cryptographic Control: StateWarden utilizes a Cascade Cryptography model (mTLS, BLAKE3, AES-256-GCM, ChaCha20-Poly1305, ML-KEM/Kyber). Zero-Knowledge Provisioning ensures that the customer retains exclusive control over cryptographic keys.
  • Data Confinement: Storage operations (driad) are confined to European jurisdictions.
  • Auditability: Realm Logs record data access events for auditing purposes.

SOV-4: Operational Sovereignty (15%)

Measures the practical ability of EU actors to run, support, and evolve a technology independently of foreign control.

• Assessment: SEAL-4
• Justification:
  • External Dependencies: The platform minimizes external dependencies, utilizing native implementations (e.g., a native iSCSI Target Server built into the Rust Agent).
  • Maintainability: Core components are written in Rust, supporting deep technical control and maintainability.
  • Vendor Lock-in: StateWarden does not require proprietary, closed-source ecosystems from non-EU vendors.

SOV-5: Supply Chain Sovereignty (20% - Highest Weight)

Evaluates the geographic origin, transparency, and resilience of the technology supply chain.

• Assessment: SEAL-3 to SEAL-4
• Justification:
  • Hardware: Hosted on OVHcloud bare-metal servers (an EU provider). While physical silicon originates globally, logical control over the bare-metal servers is maintained within the EU.
  • Software Origin: The software stack is developed within the EU.
  • Open Source Resilience: Software dependencies are actively managed and pinned to ensure stability.

SOV-6: Technology Sovereignty (15%)

Evaluates the degree of openness, transparency, and independence in the underlying technological stack.

• Assessment: SEAL-4
• Justification:
  • Independence: Internal services (e.g., Hermes for SMTP, Vigil for threat feeds) replace external dependencies.
  • Transparency: Integration with open standards (QMP/NBD for Proxmox, OSV/NVD for vulnerabilities) is utilized instead of proprietary formats.

SOV-7: Security & Compliance Sovereignty (10%)

Measures the extent to which security operations, compliance obligations, and resilience measures are controlled within the EU.

• Assessment: SEAL-3 (targeting SEAL-4 upon certification)
• Justification:
  • Operations Control: Security operations and logging are under EU control.
  • Compliance: Adheres to GDPR (Art. 32) and supports NIS2 and DORA compliance mechanisms.
  • Gap: StateWarden does not yet hold ISO/IEC 27001 or ENISA certifications, which are contributing factors for a higher level in this category. StateWarden is currently pursuing these certifications.

SOV-8: Environmental Sustainability (5%)

Assesses autonomy and resilience of cloud services over the long term in relation to energy usage.

• Assessment: SEAL-4
• Justification:
  • Energy Source: Data centers utilize renewable energy sources.
  • Efficiency: The implementation of core components in Rust provides a low computational footprint, contributing to power usage effectiveness (PUE) at the software level.