SEAL
How sovereign is your solution, really?
An independent assessment of your solution on the SEAL scale of the EU Cloud Sovereignty Framework — graded per dimension, with every datum's state on the record. Our judgment in the language of public tenders, not an official Commission certification.
How the assessment works
Every assessment runs the same way. The level you can reach is capped by the strength of the proof — no high score without evidence. That single rule is what keeps it honest and out of sovereignty-washing.
| Level | How it's reached | What it means |
|---|---|---|
| SEAL-1 | assessed from public sources | we read the public record; the score is capped here until the facts are confirmed |
| SEAL-2 | you confirm the facts | you validate each datum via your private supplier link — the cap rises to declared |
| SEAL-3 | verified & signed | hard evidence reviewed against primary sources and signed — the full level |
What we assess
Three sovereignty dimensions, each as a [value, state] pair, mapped onto the EU framework's
objectives:
- corporate jurisdiction — ownership and legal control (SOV-1/2)
- data residence — where the data actually lives (SOV-3)
- technological dependencies — the supply chain, the least substitutable axis (SOV-5, the heaviest)
The aggregate SEAL is the weakest link across the dimensions — exactly how a tender reads it: below the threshold on one objective and the offer is out.
Honesty over the data — the state of every datum
Nothing is dressed up. Every datum carries how we know it: verified (independent proof) · documented (with a source) · declared (by you, not yet verified) · web/extracted (found online, unconfirmed) · to-verify / not-declared. The SEAL is capped by the weakest state: a merely declared datum can never score like a verified one — so a machine reading the public web can never push you past SEAL-1 on its own.
What you receive
- a dated, signed attestation — a readable document plus a machine-readable record;
- the SEAL per dimension and the aggregate, each shown with its data-state (how proven it is);
- the source behind every fact that supports a level;
- a verifiable URL — the live attestation — and a "Verified by Sovrafit — SEAL-x" badge that resolves to it (so it can't be faked or go stale);
- a form you can drop straight into a tender / procurement file.
# the attestation record (shape — illustrative values) { "type": "sovrafit_seal_attestation", "method_version": "Sovrafit SEAL v1", "as_of": "2026-06-10", "solution": { "id": "example-solution", "name": "Example Solution" }, "seal": { "jurisdiction": 3, "data_residence": 2, "dependencies": 2, "aggregate": 2 }, "data_state": { "jurisdiction": "documented", "data_residence": "declared", "dependencies": "web" }, "signed_by": "unsigned draft — web cap (SEAL-1) until reviewed", "verify_url": "https://api-catalogo.sovrafit.eu/v1/verify/<token>" }
The wall — §4.5
You pay for the assessment, never for a good score — like paying an auditor to check you, not to promote you. A low, honest result is a valid outcome. Commercial terms (referral, take-rate) live in a separate layer that never touches the judgment.
Ours, not the Commission's
The SEAL scale is the EU's; the verdict is ours — an independent assessment expressed in the framework's language. It's a rating, not a state seal, and not an award from any procurement. Saying so plainly is the point: it's the opposite of the sovereignty-washing we exist to call out.
Start your assessment
Tell us about your solution. We run the standard assessment from public sources, share what we found, then you confirm the facts to raise the level — and we return the signed attestation.
Start your assessment →