Last verified: 28 September 2026
Compliance Posture
Every framework Sovern aligns with, auto-projected from the canonical registry.
Generated from lib/registry/compliance-frameworks-registry.ts · 20 active frameworks · 7 excluded clusters · cross-reference: lib/registry/compliance-domains-registry.ts (13 domain keys)
Closed taxonomy (registry keys)
Tier labels: jurisdictional-substrate, jurisdictional-customer-predicate, sector-mandatory, voluntary-attestation · Scope labels: substrate, deployment, org · Domain keys: data-protection, consumer-protection, accessibility, ai-algorithmic, sector-specific, tax, whistleblower-ethics, sustainability-esg, security-attestation, business-continuity, anti-bribery, export-controls, dual-use
Active frameworks
gdpr
Archive line tier-5-infra-ops.md#L2247.
domain: data-protection · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment, org · expansionTrigger: tier-1-jurisdiction-entered · DSR SLA: 30 days
dsa
Archive line tier-5-infra-ops.md#L2248.
domain: consumer-protection · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
nis2
Archive line tier-5-infra-ops.md#L2249.
domain: sector-specific · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
dora
Archive line tier-5-infra-ops.md#L2250.
domain: sector-specific · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: jv-bespoke, on-prem · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
eu-ai-act
Archive line tier-5-infra-ops.md#L2251.
domain: ai-algorithmic · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
eu-accessibility-act
Archive line tier-5-infra-ops.md#L2252.
domain: accessibility · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
wcag-2-1-aa
Archive line tier-5-infra-ops.md#L2253.
domain: accessibility · tier: jurisdictional-substrate · jurisdiction: EU+US+global · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate · expansionTrigger: tier-1-jurisdiction-entered
eu-vat-directive
Archive line tier-5-infra-ops.md#L2254.
domain: tax · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate · expansionTrigger: tier-1-jurisdiction-entered
eu-whistleblower-2019-1937
Archive line tier-5-infra-ops.md#L2255.
domain: whistleblower-ethics · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
eu-csrd-esrs
Archive line tier-5-infra-ops.md#L2256.
domain: sustainability-esg · tier: jurisdictional-substrate · jurisdiction: EU · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: substrate, deployment · expansionTrigger: tier-1-jurisdiction-entered
uk-gdpr
Archive line tier-5-infra-ops.md#L2263.
domain: data-protection · tier: jurisdictional-customer-predicate · jurisdiction: GB · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: deployment, org · expansionTrigger: tier-2-customer-predicate-onboarded · DSR SLA: 30 days
swiss-fadp
Archive line tier-5-infra-ops.md#L2264.
domain: data-protection · tier: jurisdictional-customer-predicate · jurisdiction: CH · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: deployment, org · expansionTrigger: tier-2-customer-predicate-onboarded · DSR SLA: 30 days
ccpa-cpra
Archive line tier-5-infra-ops.md#L2265.
domain: data-protection · tier: jurisdictional-customer-predicate · jurisdiction: US-CA · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: deployment, org · expansionTrigger: tier-2-customer-predicate-onboarded · DSR SLA: 45 days
hipaa
Archive line tier-5-infra-ops.md#L2272.
domain: sector-specific · tier: sector-mandatory · jurisdiction: US · applicableModes: jv-bespoke, on-prem, air-gapped · applicableScopes: deployment · expansionTrigger: tier-3-sector-jv-declared
pci-dss
Archive line tier-5-infra-ops.md#L2273.
domain: sector-specific · tier: sector-mandatory · jurisdiction: global · applicableModes: saas, on-demand, on-prem, air-gapped, jv-bespoke · applicableScopes: deployment · expansionTrigger: tier-3-sector-jv-declared
soc2-type1
Archive line tier-5-infra-ops.md#L2280.
domain: security-attestation · tier: voluntary-attestation · jurisdiction: US · applicableModes: saas, on-demand · applicableScopes: substrate · expansionTrigger: tier-4-gg-amendment
soc2-type2
Archive line tier-5-infra-ops.md#L2281.
domain: security-attestation · tier: voluntary-attestation · jurisdiction: US · applicableModes: saas, on-demand · applicableScopes: substrate · expansionTrigger: tier-4-gg-amendment
iso27001
Archive line tier-5-infra-ops.md#L2282.
domain: security-attestation · tier: voluntary-attestation · jurisdiction: global · applicableModes: saas, on-demand · applicableScopes: substrate · expansionTrigger: tier-4-gg-amendment
iso27701
Archive line tier-5-infra-ops.md#L2283.
domain: security-attestation · tier: voluntary-attestation · jurisdiction: global · applicableModes: saas, on-demand · applicableScopes: substrate · expansionTrigger: tier-4-gg-amendment
iso22301
Archive line tier-5-infra-ops.md#L2284.
domain: business-continuity · tier: voluntary-attestation · jurisdiction: global · applicableModes: saas, on-demand · applicableScopes: substrate · expansionTrigger: tier-4-gg-amendment
Excluded frameworks
cbam
Sector-mandatory (importers of carbon-intensive goods into EU). No Sovern-Digital exposure, no declared customer.
clusterKeys: cbam · expansion when admitted: tier-3-sector-jv-declared · archive tier-5-infra-ops.md#L2290
fin-aml-cluster
Sector-mandatory (fin). Enter registry when first fin-JV / fin-customer triggers.
clusterKeys: amld6, fatf · expansion when admitted: tier-3-sector-jv-declared · archive tier-5-infra-ops.md#L2291
non-eu-data-protection-cluster
Tier-2 customer-predicate-gated. Auto-enter when Sovern Cloud knowingly onboards first customer with data subjects in that jurisdiction.
clusterKeys: pipl, popia, pdpa-sg, appi, pipa-kr, lgpd · expansion when admitted: tier-2-customer-predicate-onboarded · archive tier-5-infra-ops.md#L2292
export-controls-cluster
Export controls. No controlled tech in substrate; no controlled-goods data v1.
clusterKeys: us-ear, us-itar, eu-dual-use · archive tier-5-infra-ops.md#L2293
consumer-protection-b2c-cluster
Consumer protection beyond DSA. Sovern is B2B; UCPD/CRD apply to B2C surfaces that customer orgs carry.
clusterKeys: eu-ucpd, eu-crd · archive tier-5-infra-ops.md#L2294
fedramp
Z5 horizon (US federal deployments).
clusterKeys: fedramp · expansion when admitted: tier-4-gg-amendment · archive tier-5-infra-ops.md#L2295
sox
Customer-org-carried only. Not substrate responsibility.
clusterKeys: sox · archive tier-5-infra-ops.md#L2296
Visibility
Registry rows with posture planned are omitted from Active frameworks unless you append ?include=planned to this URL. Rows with posture not-applicable are omitted from the active list and listed separately when present.
v1 posture note
This trust page renders the registry inventory; per-environment posture state will surface from substrate_compliance_posture once GG-iii service writes are exercised in production. See docs/architecture/DECISIONS.md §GG.