US law can apply to US-parented providers wherever data is stored
The US CLOUD Act of 2018 allows US authorities to require US-based providers to produce data in their possession, custody or control, including data held outside the United States.
Jurisdictional exposure for UK and EU organisations
Know which US-controlled services your organisation depends on.
Hosting data in Europe does not settle who can legally reach it. Digital Sovereignty Audit maps your dependence on US-parented software and cloud providers, scores it against a published method, and sets out options for reducing it.
Why it matters
Three facts that explain why location alone is not enough
None of these is a prediction. Each is a feature of the current legal and commercial position that a regulator, customer or board may ask you about.
The EU-US Data Privacy Framework is still being tested in court
Many transfers rely on the framework. It has been challenged before the EU courts and the challenge continues on appeal. Standard contractual clauses are the usual fallback and carry their own assessment duties.
Support, updates and licensing can change with little notice
Sanctions, export controls and commercial terms can alter what a provider is able or willing to supply. Few organisations have tested how they would exit.
What the free snapshot sees
Most dependence sits below the surface
From the outside, we can read your email routing, your DNS provider and the third-party services your home page loads. It cannot see the software your staff sign in to, your contracts, or how your encryption keys are held. A full audit covers those.
- The snapshot shows evidence that a dependency exists.
- It does not show how data flows or what is stored.
- It states these limits in the report itself.
The method
Seven dimensions, scored from 0 to 4, using evidence
The audit scores each dependency against seven published dimensions. The overall level is the worst result, because one weak point is enough to define the exposure. The free snapshot supplies evidence for ownership only.
RF-1
Ownership and control
Who owns the provider, and where that parent is based.
Evidence in snapshotRF-2
Legal reach
Which foreign laws can compel the provider.
AuditRF-3
Transfer basis
The mechanism relied on for any transfer outside the UK or EU.
AuditRF-4
Operational dependency
Who runs the service, from where, and what happens if support stops.
AuditRF-5
Cryptographic control
Who holds the keys that protect your data.
AuditRF-6
Supply chain
Sub-processors and upstream providers behind the service.
AuditRF-7
Portability
How easily you could move your data and processes elsewhere.
AuditResult
Overall level
The worst dimension sets the level for each dependency.
0 None identified
1 Low
2 Moderate
3 High
4 Critical
Levels are aligned in approach to the European Commission's Cloud Sovereignty Framework. Scores describe technical and legal exposure. They are not a legal conclusion about any transfer.
Self-check
Seven signs your dependence is larger than it looks
Any one of these is common and may be acceptable. Together they are a reason to measure rather than assume.
Your only assurance is "the data is in the EU"
Residency answers where data sits. It does not answer who can be compelled to produce it.
Email and documents run on a US-parented suite
Mail, files and calendars concentrate a great deal of sensitive material with one provider.
Your identity provider is also US-parented
Single sign-on controls access to everything else. Its location and ownership matter more than most.
DNS or a content network sits in front of your site
These services see traffic metadata for your whole public presence and are easy to overlook.
Backups sit with the same provider as production
A single supplier relationship then covers both your live data and your recovery plan.
Nobody has reviewed the transfer basis in the last year
Frameworks and contract terms change. A review from last year may no longer hold.
You have never tested an exit
Without a tested way to export and move, a dependency is harder to reduce than it appears.
How it works
Start free, go deeper only if the evidence justifies it
Exposure Snapshot
Free
- Public data only, one request to your home page
- Named services, their parent company and country
- A visible exposure band
- Plain statement of what it could not see
Full audit
Fixed fee, scoped with you
- Staff questionnaire and system inventory
- Contract and transfer review
- Scoring on all seven dimensions
- Prioritised plan with alternatives
Monitoring
Subscription
- Scheduled re-scans of your domains
- Alerts when a provider's ownership or terms change
- A live register for your data protection officer
Read before you request it
What the free report does and does not tell you
It tells you
- Which catalogued services appear in your public email, DNS and home page.
- The parent company and country of each, with the evidence it came from.
- Hosts it could not classify, so the gaps are visible.
- A visible exposure band: none identified, some, or several.
It does not tell you
- What software your staff use behind a login.
- Where data is stored, how it flows, or what is transferred.
- Your contract terms, transfer basis or key management.
- Whether any transfer is lawful. It is technical evidence, not legal advice.
Some catalogue entries have not yet been reviewed by a maintainer. Where the report uses one, it says so.
Snapshot and audit
What each stage covers
| Capability | Free snapshot | Audit |
|---|---|---|
| Services visible from outside | Yes | Yes |
| Parent company and country | Yes | Yes |
| Internal and sign-in applications | No | Yes |
| Contracts and transfer basis | No | Yes |
| Scoring on seven dimensions | No | Yes |
| Alternatives and migration order | No | Yes |
| Evidence cited for each finding | Yes | Yes |
Questions
Frequently asked questions
Is this legal advice?
No. Digital Sovereignty Audit produces technical evidence and a structured assessment. It does not conclude whether any transfer or supplier is lawful. Use the output to support review by your data protection officer or legal adviser.
How does the free scan work, and is it intrusive?
It reads public records: your email routing and DNS, and one request to your home page to list the third-party services it loads. It does not probe ports, attempt to sign in or touch anything behind a login.
What do you keep?
The domain, your email address, your consent choice with a timestamp, and the report. The privacy notice states how long each is kept. Marketing contact only happens if you tick the optional box.
Will the report tell me to stop using US providers?
No. It describes exposure and does not recommend or criticise any vendor. Some dependence is reasonable for some organisations. The aim is to make it visible and deliberate.
How accurate is the vendor information?
Each catalogue entry cites its sources and carries a review status. Entries not yet reviewed by a maintainer are marked as such in the report. If a classification looks wrong, tell us and it is corrected.
Who is this for?
UK and EU organisations that need to evidence their supplier position to customers, regulators or a board, and those planning to reduce dependence over time.
What does the audit cost?
It is a fixed fee agreed after a short scoping conversation, based on the number of systems and entities in scope. The snapshot is free and carries no obligation.
Free Exposure Snapshot
See what is visible about your organisation today
One page, built from public data, with its limits stated at the top.