{
  "schema": "transparencykit/report/v1",
  "provider": {
    "name": "So Sovereign Cloud SA",
    "legal_entity": "So Sovereign Cloud SA",
    "country": "CH",
    "contact": "transparency@so-sovereign.example",
    "website": "https://so-sovereign.example",
    "service_type": "provider of hosting services"
  },
  "period": {
    "label": "2026",
    "start": "2026-01-01",
    "end": "2026-12-31",
    "as_of": "2026-10-15"
  },
  "version": 1,
  "generated_at": "2026-10-15T23:32:37Z",
  "ledger": {
    "seq": 117,
    "hash": "sha256:0b9ca3845bde415ca0d4521031ec3bab8b0e27c37308958747a9eb28ed0b9c5a"
  },
  "home_jurisdictions": [
    "CH",
    "EU",
    "EEA"
  ],
  "min_count": 3,
  "government_requests": {
    "total": 29,
    "accounts_specified": 53,
    "by_country": [
      {
        "country": "CH",
        "third_country": false,
        "total": 17,
        "disclosed": 6,
        "rejected": 9
      },
      {
        "country": "DE",
        "third_country": false,
        "total": 5,
        "disclosed": "1-2",
        "rejected": "1-2"
      },
      {
        "country": "FR",
        "third_country": false,
        "total": 4,
        "disclosed": "1-2",
        "rejected": "1-2"
      },
      {
        "country": "AT",
        "third_country": false,
        "total": "1-2",
        "disclosed": "1-2",
        "rejected": 0
      },
      {
        "country": "US",
        "third_country": true,
        "total": "1-2",
        "disclosed": 0,
        "rejected": "1-2"
      }
    ],
    "by_authority_type": null,
    "by_kind": null,
    "by_outcome": {
      "actioned": "1-2",
      "disclosed_full": "1-2",
      "disclosed_partial": 10,
      "no_data": "1-2",
      "pending": 0,
      "rejected": 13,
      "withdrawn": "1-2"
    },
    "by_data_category": {
      "both": 0,
      "content": 10,
      "non_content": 18,
      "none": 0
    },
    "customer_notification": null,
    "disclosure_rate_pct": "41.4–48.3",
    "median_hours_to_respond": 24,
    "third_country": {
      "total": "1-2",
      "by_country": {
        "US": "1-2"
      },
      "by_outcome": {
        "actioned": 0,
        "disclosed_full": 0,
        "disclosed_partial": 0,
        "no_data": 0,
        "pending": 0,
        "rejected": "1-2",
        "withdrawn": 0
      },
      "customer_notification": {
        "not_applicable": 0,
        "not_notified_legal_prohibition": 0,
        "not_notified_other": 0,
        "notified_after": 0,
        "notified_before": "1-2"
      }
    }
  },
  "abuse_notices": {
    "total": 80,
    "by_source": {
      "art16_notice": 59,
      "other_notification": 0,
      "own_initiative": 10,
      "trusted_flagger": 11
    },
    "by_category": null,
    "by_action": {
      "account_suspended": 7,
      "account_terminated": 0,
      "disabled": 15,
      "forwarded_to_customer": 44,
      "none": 7,
      "removed": 7,
      "restricted": 0
    },
    "by_basis": {
      "law": 67,
      "none": 7,
      "terms": 6
    },
    "median_hours_to_action": 2
  },
  "subprocessors": {
    "current": [
      {
        "name": "Franc Fort Payments SA",
        "purpose": "Card payment processing",
        "locations": [
          "CH"
        ],
        "services": [
          "billing"
        ],
        "since": "2026-10-01"
      },
      {
        "name": "Helpdesk Helden GmbH",
        "purpose": "Second-level support (no data access by default)",
        "locations": [
          "DE"
        ],
        "services": [
          "support"
        ],
        "since": "2025-09-01"
      },
      {
        "name": "Pigeon Post AG",
        "purpose": "Transactional e-mail and SMS",
        "locations": [
          "CH",
          "AT"
        ],
        "services": [
          "portal"
        ],
        "since": "2025-03-01"
      }
    ],
    "changes_in_period": [
      {
        "effective": "2026-05-01",
        "change": "update",
        "name": "Pigeon Post AG",
        "purpose": "Transactional e-mail and SMS",
        "locations": [
          "CH",
          "AT"
        ],
        "services": [
          "portal"
        ],
        "notice_given": "2026-04-01"
      },
      {
        "effective": "2026-10-01",
        "change": "add",
        "name": "Franc Fort Payments SA",
        "purpose": "Card payment processing",
        "locations": [
          "CH"
        ],
        "services": [
          "billing"
        ],
        "notice_given": "2026-09-01"
      }
    ],
    "upcoming": []
  },
  "infrastructure": [
    {
      "effective": "2025-01-01",
      "zone": "ch-lmn-1",
      "country": "CH",
      "city": "Geneva",
      "operator": "Lac Léman Datacentre SA",
      "operator_country": "CH",
      "legal_entity": "So Sovereign Cloud SA",
      "legal_entity_country": "CH",
      "services": [
        "compute",
        "object-storage",
        "kubernetes"
      ],
      "status": "active"
    },
    {
      "effective": "2025-01-01",
      "zone": "ch-uet-1",
      "country": "CH",
      "city": "Zurich",
      "operator": "Uetliberg Rechenzentrum AG",
      "operator_country": "CH",
      "legal_entity": "So Sovereign Cloud SA",
      "legal_entity_country": "CH",
      "services": [
        "compute",
        "object-storage"
      ],
      "status": "active"
    },
    {
      "effective": "2025-06-01",
      "zone": "de-mai-1",
      "country": "DE",
      "city": "Frankfurt",
      "operator": "Mainhattan Colocation GmbH",
      "operator_country": "DE",
      "legal_entity": "So Sovereign Cloud SA",
      "legal_entity_country": "CH",
      "services": [
        "compute",
        "object-storage"
      ],
      "status": "active"
    }
  ],
  "measures": {
    "effective": "2026-01-01",
    "statement": "Your data stays in the zone you pick, run by Swiss and EU companies only. Nobody here answers to a foreign subpoena, and we have the signed ledger to prove it.",
    "technical": [
      "Encryption at rest for block and object storage, keys held in-zone",
      "Customer-provided keys (SSE-C) for object storage",
      "Administrative access via in-zone bastions with hardware-key MFA and session logging"
    ],
    "organisational": [
      "Every authority request is reviewed by Legal; requests without a valid basis under Swiss or EU law are rejected",
      "Staff with production access are employed by EU/Swiss entities",
      "Annual external audit of access controls"
    ],
    "contractual": [
      "DPA commits to challenge, minimise and notify on third-country requests (Data Act Art. 32)",
      "Subprocessors bound by equivalent obligations and 30-day change notice"
    ]
  },
  "withheld": [
    {
      "section": "government_requests.by_authority_type",
      "would_reveal": [
        "regulator"
      ],
      "reason": "counts below 3 could be calculated from the published total"
    },
    {
      "section": "government_requests.by_kind",
      "would_reveal": [
        "content_action"
      ],
      "reason": "counts below 3 could be calculated from the published total"
    },
    {
      "section": "government_requests.customer_notification",
      "would_reveal": [
        "notified_after"
      ],
      "reason": "counts below 3 could be calculated from the published total"
    },
    {
      "section": "abuse_notices.by_category",
      "would_reveal": [
        "STATEMENT_CATEGORY_PROTECTION_OF_MINORS"
      ],
      "reason": "counts below 3 could be calculated from the published total"
    }
  ]
}