When selecting a managed hosting or cloud provider, digital sovereignty is increasingly becoming a decisive factor. Organizations no longer want to know only where their data is stored, but more importantly, under which jurisdiction and operational control that data falls. The challenge is that while “sovereignty” is frequently mentioned, it is rarely measured in a consistent and objective way. In this article, we explain how digital sovereignty can be structured, which frameworks have emerged, and how Shock Media makes its cloud services transparent and measurable.
What is digital sovereignty?
Digital sovereignty refers to the degree to which an organization has actual control over its data, infrastructure, and operational layers from a legal, operational, and technical perspective. It is important to understand that the physical location of a datacenter is only one aspect. A datacenter located in the Netherlands does not automatically mean that all associated processes are governed under Dutch or European jurisdiction.
A well-known example that brought this discussion to the forefront in the Netherlands is the debate surrounding Solvinity, the IT service provider behind the infrastructure of DigiD.
In certain situations, foreign legislation such as the U.S. CLOUD Act may, through legal procedures, also affect data stored outside the United States. Under specific conditions, this applies to providers that fall under U.S. jurisdiction, including major hyperscalers such as AWS, Microsoft Azure, and Google Cloud. For organizations handling personal data, medical records, financial information, or business-critical systems, this is not merely a theoretical concern but a structural risk that should explicitly be considered when selecting suppliers and designing IT architectures.
But how do you measure sovereignty?
Until recently, there was no standardized methodology for objectively assessing the digital sovereignty of cloud providers. That has changed.
In October 2025, the European Commission published the EU Cloud Sovereignty Framework (CSF). This framework introduces a structured assessment methodology that enables cloud and hosting services to be evaluated across multiple dimensions of sovereignty. Among other things, the framework assesses:
- Legal foundation and jurisdiction
- Operational control and management
- Supply chain transparency
- Technical dependencies
- Security and governance structures
The outcome is expressed as a SEAL score (0–4), indicating the level of sovereignty of a particular service. Within this framework, SEAL-3 is regularly referenced in policy discussions as the benchmark for organizations processing sensitive or critical data.
In addition, in March 2026, DICTU published the Cloud Services Sovereignty Assessment Framework (Toetsingsinstrument Soevereiniteit Clouddiensten), which provides an additional set of evaluation criteria for public sector organizations. This framework focuses on areas such as autonomy, legislation and regulation, reliability, and supplier independence.
How Shock Media applies these frameworks
At present, neither the EU CSF nor the DICTU framework is a formal certification standard. To provide complete transparency about how our services align with these frameworks, Shock Media has developed its own Digital Cloud Sovereignty Assessment.
This assessment provides transparent insight into the sovereignty aspects of our managed hosting services by mapping our platform against:
- The criteria defined within the EU Cloud Sovereignty Framework (EU CSF)
- The assessment dimensions included in the DICTU Cloud Services Sovereignty Framework
Based on our Digital Cloud Sovereignty Assessment, our core managed hosting services achieve SEAL-4 within the EU CSF methodology as applied to our architecture and governance model.
Against the DICTU assessment framework, our services are positioned within the highest segment of the applied scoring model, based on our interpretation of the framework.
This reflects the way our services have been designed for many years:
- All customer data is processed and stored exclusively in datacenters located within the European Union (the Netherlands), under Dutch and European legislation.
- Shock Media is fully established and legally incorporated in the Netherlands. There is no exposure to the U.S. CLOUD Act or comparable foreign legislation.
- Our entire operational organization, engineering teams, and technical support are based in the Netherlands.
- We actively promote the use of open standards and avoid proprietary dependencies wherever possible, particularly those involving foreign third-party vendors.
- Our entire supply chain is continuously assessed, covering services, hardware, and software, and is transparently traceable to EU-based suppliers.
Meeting these digital sovereignty requirements complements our existing Security & Compliance certifications. With ISO 27001, NEN 7510, ISO 9001, and SOC 2 and ISAE 3402 Type II reports with no findings, Shock Media already demonstrates a proven commitment to security, quality, and compliance. The Digital Cloud Sovereignty Assessment adds the sovereignty dimension to this existing foundation.
What does this mean for our customers?
By hosting your business-critical applications with Shock Media, you strengthen your own compliance position and can demonstrate to regulators, auditors, and customers that your infrastructure is firmly rooted within Europe.
This is directly relevant if your organization is subject to NIS2, DORA, or the GDPR, if you work with government organizations, or if you simply want to avoid legal uncertainty regarding who may ultimately gain access to your data.
The complete Digital Cloud Sovereignty Assessment, including the mapping to both the EU Cloud Sovereignty Framework and the DICTU Cloud Services Sovereignty Assessment Framework, is available for download through our customer portal.
Would you like to know what this means for your own environment? Feel free to contact us for a no-obligation consultation.
