So Sovereign Cloud SA — 2026-01-01 to 2026-12-31
Government and authority requests
Counts between 1 and 2 are shown as a range to protect customer confidentiality. Zero is always exact. A breakdown is withheld when its ranges could be resolved by subtracting from the published total; rates are shown as a range and medians omitted when they would reveal small counts.
Scroll the table sideways for all columns.
| Country | Requests | Disclosed / actioned | Rejected |
|---|---|---|---|
| CH | 17 | 6 | 9 |
| DE | 5 | 1-2 | 1-2 |
| FR | 4 | 1-2 | 1-2 |
| AT | 1-2 | 1-2 | 0 |
| US third country | 1-2 | 0 | 1-2 |
By outcome
| Actioned | 1-2 |
| Disclosed full | 1-2 |
| Disclosed partial | 10 |
| No data held | 1-2 |
| Pending | 0 |
| Rejected | 13 |
| Withdrawn | 1-2 |
By authority type
Withheld to protect small counts.
By request kind
Withheld to protect small counts.
Data category (content vs non-content)
| Both | 0 |
| Content | 10 |
| Non-content (metadata, subscriber info) | 18 |
| None | 0 |
Customer notification
Withheld to protect small counts.
Third-country requests
Requests from authorities outside CH, EU, EEA, e.g. under the US CLOUD Act. Under Data Act Art. 32(5) the customer is informed before compliance, except for law-enforcement confidentiality.
Outcome (third-country)
| Actioned | 0 |
| Disclosed full | 0 |
| Disclosed partial | 0 |
| No data held | 0 |
| Pending | 0 |
| Rejected | 1-2 |
| Withdrawn | 0 |
Customer notification (third-country)
| Not applicable | 0 |
| Not notified (legal prohibition) | 0 |
| Not notified (other reason) | 0 |
| Notified after disclosure | 0 |
| Notified before disclosure | 1-2 |
Abuse notices and own-initiative measures
By source
| Art. 16 notice | 59 |
| Other notification | 0 |
| Own initiative | 10 |
| Trusted flagger | 11 |
By category (non-zero)
Withheld to protect small counts.
By action
| Account suspended | 7 |
| Account terminated | 0 |
| Disabled | 15 |
| Forwarded to customer | 44 |
| None | 7 |
| Removed | 7 |
| Restricted | 0 |
DSA Art. 15 figures (exact, template-aligned CSV): identification · Member State orders · notices · own initiative (illegal) · own initiative (T&C) · qualitative · notes
Subprocessors
Scroll the table sideways for all columns.
| Name | Purpose | Locations | Since |
|---|---|---|---|
| Franc Fort Payments SA | Card payment processing | CH | 2026-10-01 |
| Helpdesk Helden GmbH | Second-level support (no data access by default) | DE | 2025-09-01 |
| Pigeon Post AG | Transactional e-mail and SMS | CH, AT | 2025-03-01 |
Changes in this period
| Effective | Change | Name | Notice given |
|---|---|---|---|
| 2026-05-01 | update | Pigeon Post AG | 2026-04-01 |
| 2026-10-01 | add | Franc Fort Payments SA | 2026-09-01 |
Infrastructure jurisdiction
See also the EU Data Act Art. 28 disclosure.
Scroll the table sideways for all columns.
| Zone | Location | Legal entity | Data-centre operator | Services |
|---|---|---|---|---|
| ch-lmn-1 | Geneva, CH | So Sovereign Cloud SA (CH) | Lac Léman Datacentre SA (CH) | compute, object-storage, kubernetes |
| ch-uet-1 | Zurich, CH | So Sovereign Cloud SA (CH) | Uetliberg Rechenzentrum AG (CH) | compute, object-storage |
| de-mai-1 | Frankfurt, DE | So Sovereign Cloud SA (CH) | Mainhattan Colocation GmbH (DE) | compute, object-storage |
Verify this report
Every number on this page is derived from a hash-chained, append-only ledger. All files of this publication are listed with their SHA-256 in manifest.json, signed with Ed25519 (manifest.sig, key ed25519:393c7a476c60c098).
Obtain So Sovereign Cloud SA's public key from a source you trust independently of this site (contract, DPA or main website), then run:
tkit verify --pubkey provider.pub --chain https://transparencykit.dev/example
A copy of the key served next to the reports only shows that the files are consistent, not who signed them. Exit code 0 means every signature, file and chain link matched.