{"page":"/blog/eu-cloud-sovereignty-framework","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Ad tech data flow","Framework criterion","What the criterion asks"],"rows":[["Bid requests sent to exchanges and bidders","SOV-3, data location","Is any processing outside the EU, and with what fallback?"],["Audience segments in a DMP, CDP or clean room","SOV-3, encryption keys and deletion","Who holds the keys, and can erasure be proven?"],["Log-level data and reporting","SOV-3, access logs; SOV-7, monitoring","Can the customer see who accessed data, and when?"],["Vendor support and on-call access","SOV-4, support channels","Are escalation teams inside the EU?"],["Vendor ownership","SOV-1 and SOV-2","Could a non-EU authority compel access, for example under the CLOUD Act?"],["Exit from a vendor","SOV-4, portability","Are standard export methods documented?"]],"sourceUrls":[[],[],[],[],[],[]]}