Sovereignty
Dependencies, jurisdiction, data placement, key control and exit paths, source against target.
Sovereignty is not residency, and it is never expressed as a percentage or a score. This page is technical evidence and gaps: it does not certify legal compliance, and legal conclusions stay with counsel.
Requirement
Sovereignty requirement: not provided. No sovereignty requirement was provided: no applications file gives a tier or constraints. It is not inferred from the location of the company or of the provider.
The thirteen dimensions
Each dimension states the requirement, what the source shows, what the target is proposed to be, the delta, the evidence, what is unknown and the actions. A statement that reads not assessed says that this build has no evidence for it; it is not a finding.
| Dimension | State | Requirement | Observed in the source | Proposed for the target | Delta | Evidence | Unknowns | Actions |
|---|---|---|---|---|---|---|---|---|
| Data location | Evidence required | NOT_PROVIDED | Not assessed The location of the source resources is not read: this build computes no region or zone placement for the source. | Stated The capability catalogue lists the STACKIT services of the draft as available in: eu01, eu02. That a service is available in a region is a fact about the service. Region assumed for pricing: eu01 (default; no input chose a region). The catalogue lists the service of 4 units there, but no input or profile has chosen the region, so no resource is tied to it. | Not assessed No source location is established, so no change of location is stated. | pointers into workspace.json | The provider's own statement on data location is a statement of the provider with control shared: STACKIT states that the development of its cloud takes place in Germany, that its servers and data centers are located in Germany and Austria, and that its cloud operates in accordance with European data protection standards. It names no region id, so it does not tie any resource of the draft to a region. Where backups, logs and replicas are stored is the subject of the backup chain and the telemetry chain. |
|
| Jurisdiction chain | Not assessed | NOT_PROVIDED | Not assessed The jurisdiction chain (the legal seat of the provider, of its owners and of its operators, and the legal reach over them) is not assessed. It is not a fact of the Terraform source or of the draft, and legal conclusions stay external. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | Which legal order applies to the provider, to its parent organisations and to its operators is a question for counsel, not for this build. |
||
| Operator access | Not assessed | NOT_PROVIDED | Not assessed Who at the provider or at an operator can reach the resources and the data, and under which conditions, is not assessed. It is not a fact of the Terraform source or of the draft. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | The access model of the provider's staff and subcontractors is not a fact of the Terraform source. |
||
| Key control | Not assessed | NOT_PROVIDED | Not assessed No unit's contract observes a customer-managed key or an encrypted volume. That is a reading of the contracts this build holds, not a finding that no key is used. | Not assessed No target state is stated: the source state is not established. | Not assessed Whether key ownership changes is not established: the key of the source and the key of the target are not compared. | Who holds the keys of the data the source stores is not established. |
||
| Identity chain | Decision required | NOT_PROVIDED | Stated The source names identities for its workloads or states them as units: google_cloud_run_v2_job.migrate, google_cloud_run_v2_service.server. | Stated The draft attaches a STACKIT service account to a server only where the identity plan attaches it exactly; every other attachment is stated as open. Where the draft writes a project role assignment (for a Google Cloud service account or the IAM binding of a member it turns into service accounts or members), the role it grants is a variable the architect chooses, because a Google Cloud permission is not translated into a STACKIT role: the draft derives no role from the source. | Not assessed Whether the identity dependency changes is not established: the privilege delta and the external identity provider are not assessed. | pointers into workspace.json | Whether an external identity provider is a dependency of the sign-in of people is not assessed. The privilege delta between the source identities and the target roles is not assessed. |
the step "Decide how google_cloud_run_v2_job.migrate gets its application identity on…" the step "Decide how google_cloud_run_v2_service.server gets its application identity on…" |
| Telemetry chain | Not assessed | NOT_PROVIDED | Not assessed No log sink of the source is read in this run. That is not a finding that no telemetry leaves the estate. | Not assessed No log source plan was produced in this run, so no target state is stated. | Not assessed Whether the destination of the telemetry changes is not established. | Where metrics, traces and agent telemetry go is not read by this build. |
||
| Backup chain | Evidence required | NOT_PROVIDED | Stated The contracts of the source observe a backup, retention or geo-replication setting on: google_storage_bucket.media. | Not assessed Where the backups of the target are stored and who operates the destination is not stated by the draft or by this build. | Not assessed Whether the destination of the backups changes is not established. | pointers into workspace.json | The destination of the backups and replicas, and the jurisdiction of that destination, are not assessed. |
|
| Supply chain | Observed | NOT_PROVIDED | Stated The source records these Terraform providers, required by its configuration or locked in its lock file: google, google-beta, http, random, time. | Stated The draft is written for the STACKIT provider 0.121.0. | Not assessed Whether the supply chain of the estate changes is not established. | pointers into workspace.json | The registries and the build chain of the providers, and the provenance of the modules the source calls, are not assessed. |
|
| Third-party processing | Evidence required | NOT_PROVIDED | Stated The source depends on providers or resource types the knowledge base holds no schema of: provider http, provider random, provider time. | Not assessed The draft names no STACKIT counterpart for these dependencies. | Not assessed Whether a third party processes the data after the move is not established. | pointers into workspace.json | What data a third-party provider or service handles is not read from the Terraform source. |
|
| Open interfaces | Not assessed | NOT_PROVIDED | Not assessed Whether the interfaces the source depends on are open standards and whether the target keeps them is not assessed. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | Which of the interfaces the source uses are proprietary is not read. |
||
| Data portability | Not assessed | NOT_PROVIDED | Not assessed Whether the data can be exported in a documented format, and by which path, is not assessed. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | How the data of each stateful unit leaves its service is not read. |
||
| Application coupling | Not assessed | NOT_PROVIDED | Not assessed The coupling of application code to the interfaces of the source (SDKs, proprietary protocols) is not assessed: the application code is not scanned. | Not assessed No target state is stated: the source state is not established. | Not assessed No change is stated. | Which SDKs and protocols the application code uses is not read. |
||
| Exitability | Observed | NOT_PROVIDED | Not assessed The interface, data format, code coupling, replacement complexity, extraction path and alternatives of the source's dependencies are not assessed. | Stated The draft is provider-specific Terraform for the STACKIT provider; that is the only exit fact stated, and it is listed per dependency in the exitability entries. | Not assessed No change of exit cost is stated: no cost, no duration and no complexity is estimated. | Every field of the exitability model but the Terraform coupling is not assessed, so no exit path is proven and none is ruled out. |
Dependencies, source to target
The dependencies of the source and what the draft makes of them. A dependency replaced is a unit the knowledge base maps to a STACKIT service; retained is a source type the knowledge base does not know, for which the draft names no counterpart.
| Source | Source type | Target service | Change | Dimensions it bears on |
|---|---|---|---|---|
provider:http | source provider | none | retained | supply chain, third-party processing |
provider:random | source provider | none | retained | supply chain, third-party processing |
provider:time | source provider | none | retained | supply chain, third-party processing |
google_cloud_run_v2_job.migrate | google_cloud_run_v2_job | Kubernetes Job/CronJob on SKE | replaced | data location, identity chain, exitability |
google_cloud_run_v2_service.server | google_cloud_run_v2_service | SKE workload (or Cloud Foundry Docker app) | replaced | data location, identity chain, exitability |
google_pubsub_topic.faux | google_pubsub_topic | STACKIT RabbitMQ | replaced | data location, exitability |
google_secret_manager_secret.django_admin_password | google_secret_manager_secret | STACKIT Secrets Manager | replaced | data location, exitability |
google_secret_manager_secret.django_settings | google_secret_manager_secret | STACKIT Secrets Manager | replaced | data location, exitability |
google_service_account.automation | google_service_account | STACKIT service account | replaced | data location, exitability |
google_service_account.client | google_service_account | STACKIT service account | replaced | data location, exitability |
google_service_account.server | google_service_account | STACKIT service account | replaced | data location, exitability |
google_sql_database_instance.postgres | google_sql_database_instance | STACKIT PostgreSQL Flex | replaced | data location, exitability |
google_storage_bucket.media | google_storage_bucket | STACKIT Object Storage | replaced | data location, backup chain, exitability |
- retained: The knowledge base holds no source schema of this provider and the draft names no STACKIT counterpart for it. What the provider processes is not established.
- replaced: The knowledge base maps this unit to the STACKIT service named; whether the draft writes it is stated in the plan of the unit.
Exitability
For each target dependency the model asks for the interface, the data format, the provider-specific code, the Terraform dependency, the replacement complexity, the data extraction path, the alternative implementation and the exit evidence. The only field this build states is the Terraform dependency: the draft is Terraform written for the STACKIT provider. No cost, duration or complexity is estimated.
| Dependency | Target service | State | Terraform dependency | Every other field of the model |
|---|---|---|---|---|
google_cloud_run_v2_job.migrate | Kubernetes Job/CronJob on SKE | Provider specific | provider specific | not assessed |
google_cloud_run_v2_service.server | SKE workload (or Cloud Foundry Docker app) | Provider specific | provider specific | not assessed |
google_pubsub_topic.faux | STACKIT RabbitMQ | Provider specific | provider specific | not assessed |
google_secret_manager_secret.django_admin_password | STACKIT Secrets Manager | Provider specific | provider specific | not assessed |
google_secret_manager_secret.django_settings | STACKIT Secrets Manager | Provider specific | provider specific | not assessed |
google_service_account.automation | STACKIT service account | Provider specific | provider specific | not assessed |
google_service_account.client | STACKIT service account | Provider specific | provider specific | not assessed |
google_service_account.server | STACKIT service account | Provider specific | provider specific | not assessed |
google_sql_database_instance.postgres | STACKIT PostgreSQL Flex | Provider specific | provider specific | not assessed |
google_storage_bucket.media | STACKIT Object Storage | Provider specific | provider specific | not assessed |
What this page does not say
- Legal conclusions remain external. The block provides technical evidence and gaps and does not certify legal compliance.
- Sovereignty is not residency: a region of a service is a fact about the service, never a statement about the sovereignty of a workload.
- There is no score, no percentage and no count in this block, and no dimension is compared with a requirement in this build.
- Jurisdiction, operator access, open interfaces, data portability and application coupling are not assessed, and every field of the exitability model but the Terraform coupling is not assessed.
- Dependencies are the units the knowledge base maps to a STACKIT service, the source providers the knowledge base holds no schema of and the source types it does not know. A dependency the draft introduces without a source unit is not listed, and a unit with no STACKIT resource is not listed as removed.
The same block, with the pointers of its evidence, is in assurance/sovereignty.json, and in words in assurance/sovereignty.md.