Sovereign cloud frameworks in Europe

The main frameworks

• EU Cloud Sovereignty Framework (SEAL). The European Commission’s scale for sovereignty in cloud procurement, scored per objective from SEAL-0 to SEAL-4.
• BSI C5 (Germany). The Cloud Computing Compliance Criteria Catalogue of the German Federal Office for Information Security, a widely used audit standard for cloud security.
• SecNumCloud (France). The French cybersecurity agency ANSSI’s qualification for trusted cloud services, with strict requirements on immunity from non-European law.
• BIO (the Netherlands). The baseline information security standard for Dutch government organisations.
• ENS (Spain). The Esquema Nacional de Seguridad, the national security framework for public sector information systems.
• ACN qualification (Italy). The qualification of cloud services for the Italian public administration by the national cybersecurity agency.

What it means for a video platform

Most frameworks share the same core: European control, clear jurisdiction, documented security and the ability to exit. StreamZilla publishes its compliance statements and SEAL self-assessment and provides the substantiation for your tender. Ask us which framework you need to meet.

How the SEAL scale works

The EU Cloud Sovereignty Framework scores eight sovereignty objectives, SOV-1 to SOV-8, each from SEAL-0 to SEAL-4. Two mechanisms work side by side:

• A floor per objective. The overall SEAL level is the lowest level reached on any objective. One weak spot sets the level.
• A weighted score. The Sovereignty Score weighs all eight objectives and ranks the offers that meet the minimum levels. Supply chain sovereignty weighs the most, at 20 percent.

There is no certification scheme behind SEAL. An official level only exists when a contracting authority assesses a supplier in a tender. Be wary of suppliers that present SEAL as a certificate.

StreamZilla’s self-assessment: SEAL-4 on seven of eight objectives

We assessed ourselves against all eight objectives, with evidence for every claim. StreamZilla reaches SEAL-4 on seven objectives and SEAL-3 on one. Because the overall level is the lowest score, our overall level today is SEAL-3.

• SOV-1 Strategic (SEAL-4): a Dutch company with a Dutch parent, ownership and financing entirely in the Netherlands, no control by any party outside the EU.
• SOV-2 Legal and jurisdictional (SEAL-4): only Dutch and European law apply. No parent, subsidiary or shareholder outside the EU, and no channel through which a non-EU authority can force access to data.
• SOV-3 Data and AI (SEAL-4): all processing within the EEA, encryption with keys in our own hands, no monetisation of your content or data. AI features run on open models on our own infrastructure in the EU, and your content never trains anyone’s model.
• SOV-4 Operational (SEAL-4): operations, support and development entirely by our own staff in the Netherlands, without outsourcing or offshore support.
• SOV-5 Supply chain (SEAL-4): an exceptionally short chain of two European suppliers, each named with country and applicable law. No hyperscaler, no analytics or advertising networks. The service runs on standard servers, without dependence on one hardware vendor.
• SOV-6 Technology (SEAL-4): open standards, no proprietary formats, no exit or egress fees, and the choice to run on shared infrastructure, your own hardware or fully air-gapped on your own premises.
• SOV-7 Security and compliance (SEAL-3): security in our own Dutch hands, with an operational ISMS and voluntary compliance with NIS2 duties. This objective stays at SEAL-3 until our ISO 27001 certification is completed: a matter of evidence, not of control.
• SOV-8 Environmental sustainability (SEAL-4): certified green data centres on renewable energy, and highly efficient encoding that needs far less storage and traffic.

Once ISO 27001 certification is completed, all eight objectives are at SEAL-4. Customers and contracting authorities can request the full self-assessment, with the evidence per objective. See trust and compliance.