{
  "schema": "transparencykit/data-act-art28/v1",
  "provider": {
    "name": "So Sovereign Cloud SA",
    "legal_entity": "So Sovereign Cloud SA",
    "country": "CH",
    "contact": "transparency@so-sovereign.example",
    "website": "https://so-sovereign.example",
    "service_type": "provider of hosting services"
  },
  "as_of": "2026-10-15",
  "generated_at": "2026-10-15T23:32:37Z",
  "legal_basis": "Regulation (EU) 2023/2854 (Data Act), Article 28(1)(a) and (b)",
  "jurisdiction_of_ict_infrastructure": [
    {
      "effective": "2025-01-01",
      "zone": "ch-lmn-1",
      "country": "CH",
      "city": "Geneva",
      "operator": "Lac Léman Datacentre SA",
      "operator_country": "CH",
      "legal_entity": "So Sovereign Cloud SA",
      "legal_entity_country": "CH",
      "services": [
        "compute",
        "object-storage",
        "kubernetes"
      ],
      "status": "active"
    },
    {
      "effective": "2025-01-01",
      "zone": "ch-uet-1",
      "country": "CH",
      "city": "Zurich",
      "operator": "Uetliberg Rechenzentrum AG",
      "operator_country": "CH",
      "legal_entity": "So Sovereign Cloud SA",
      "legal_entity_country": "CH",
      "services": [
        "compute",
        "object-storage"
      ],
      "status": "active"
    },
    {
      "effective": "2025-06-01",
      "zone": "de-mai-1",
      "country": "DE",
      "city": "Frankfurt",
      "operator": "Mainhattan Colocation GmbH",
      "operator_country": "DE",
      "legal_entity": "So Sovereign Cloud SA",
      "legal_entity_country": "CH",
      "services": [
        "compute",
        "object-storage"
      ],
      "status": "active"
    }
  ],
  "measures_against_international_governmental_access": {
    "effective": "2026-01-01",
    "statement": "Your data stays in the zone you pick, run by Swiss and EU companies only. Nobody here answers to a foreign subpoena, and we have the signed ledger to prove it.",
    "technical": [
      "Encryption at rest for block and object storage, keys held in-zone",
      "Customer-provided keys (SSE-C) for object storage",
      "Administrative access via in-zone bastions with hardware-key MFA and session logging"
    ],
    "organisational": [
      "Every authority request is reviewed by Legal; requests without a valid basis under Swiss or EU law are rejected",
      "Staff with production access are employed by EU/Swiss entities",
      "Annual external audit of access controls"
    ],
    "contractual": [
      "DPA commits to challenge, minimise and notify on third-country requests (Data Act Art. 32)",
      "Subprocessors bound by equivalent obligations and 30-day change notice"
    ]
  },
  "ledger": {
    "seq": 117,
    "hash": "sha256:0b9ca3845bde415ca0d4521031ec3bab8b0e27c37308958747a9eb28ed0b9c5a"
  }
}