Atlas – Your Icelandic Cloud Provider

Selected answer: 4. Entirely within the EU Value 125 SEAL 4

Notes: Atlas Cloud ehf. is privately held with Icelandic governance; ultimate decision-making resides entirely in Iceland (EEA) jurisdiction.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Shows ultimate governance—chairman, executives and advisors—are Icelandic actors, so decision-making authority resides in Iceland (EEA).
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms the operating legal entity is Atlas Cloud ehf. (kt. 590625-1830), registered in Reykjavík, i.e. an Icelandic EEA company.
• Mapping the Digital Infrastructure of Municipalities Across GDPR Countries other 24. September 2026
  Academic study measuring hosting location vs. provider jurisdiction across EU-27 plus EEA countries incl. Iceland.
  Relevance: Ratifies Iceland as an EEA jurisdiction and distinguishes EEA-registered provider control from foreign-owned clouds in EEA datacenters.

Selected answer: 4. Unlikely takeover by or transfer to a non-EU sovereign entity Value 93 SEAL 4

Notes: Privately held, founder-led, no public listing or foreign investors; sovereignty mission makes non-sovereign takeover unlikely.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Shows a founder-led Icelandic company; chairman and advisory board drawn from Icelandic firms (Míla, Nova), indicating domestic ownership and governance anchoring.
• Atlas – LinkedIn Company Page other 24. September 2026
  LinkedIn company page: Atlas, Reykjavík, privately held, founded 2025, 2-10 employees, Iceland sovereignty mission.
  Relevance: Confirms Atlas is privately held with 2-10 staff, founded 2025; no public shares or listed investors, limiting takeover pathways to negotiated deals.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Independent profile records no funding rounds, investors or acquisitions for Atlas Cloud ehf, indicating no visible external ownership pressure (as of Sept 2026).

Selected answer: 3. Governance bodies exist with EU actors participation Value 83 SEAL 3

Notes: Advisory board with Icelandic/EEA actors can shape evolution; no full EU influence or dedicated EU governance body found.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Shows a formal governance body (advisory board) where Icelandic/EEA stakeholders advise and shape the provider's technology and service evolution.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Corroborates a small private Icelandic provider with planned services; no EU governance channels beyond ordinary customer feedback identified.
• Cloud Sovereignty Framework – Implementation Guidance (European Commission) other 24. September 2026
  Official EC guidance defining SOV-1 Strategic Sovereignty and roadmap-control criteria (roadmap access, EU customer priority).
  Relevance: Benchmark for the Control Over Roadmap question: stakeholder influence via governance participation ranks mid-level for Atlas, not full EU control.

Selected answer: 5. Entirely EU-based funding Value 125 SEAL 4

Notes: Privately owned, no disclosed VC; funding via Icelandic TTHS grant, EU co-funding and SuperNova accelerator grant; no non-EU capital found.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Confirms Icelandic ownership and leadership; bootstrapped accelerator alumnus rather than VC-funded, supporting EEA-based financing.
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Displays 'Supported by TTHS' (Icelandic Technology Development Fund) and 'Co-funded by the European Union' logos; no non-EU capital disclosed.
• Startup SuperNova and the Startup Reykjavik legacy – Northstack other 24. September 2026
  Icelandic startup-news outlet explaining Startup SuperNova's funding model (1M ISK grant, optional 5% equity call) backed by Nova/Gróska.
  Relevance: SuperNova funding is a 1M ISK grant with an optional 5% call, from Icelandic backers (KLAK, Nova/Novator) — EEA-based, not non-EU capital.

Selected answer: 2. Some Value 31 SEAL 4

Notes: All jobs, investment and value creation sit in Iceland (EEA), but this tiny 2025 startup (2–10 staff) has limited economic scale.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Demonstrates jobs, team, and value creation are anchored in Iceland/EEA, but at a small startup scale.
• Atlas – LinkedIn Company Page other 24. September 2026
  LinkedIn company page: Atlas, Reykjavík, privately held, founded 2025, 2-10 employees, Iceland sovereignty mission.
  Relevance: Shows company size and founding year, indicating limited jobs created in Iceland/EEA; supports 'Some' rating on economic contribution.
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms all operations, investment, and infrastructure are in Iceland (EEA), locally registered and hosted.

Selected answer: 1. No clear participation Value 0 SEAL 4

Notes: No evidence of Atlas Cloud involvement in IPCEI-CIS, Horizon Europe or Gaia-X; Gaia-X member lists and IPCEI participants exclude it.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Official profile cites only Icelandic accelerator backing; no mention of Gaia-X, Horizon Europe, or IPCEI-CIS involvement.
• European Commission — Approved IPCEI on Next Generation Cloud Infrastructure and Services other 29. August 2026
  Official EC page listing 19 companies from 7 member states participating in IPCEI-CIS, a €1.2B+ cloud-edge initiative approved Dec 2023.
  Relevance: Official IPCEI-CIS participant and Member State list; neither Atlas Cloud nor Iceland appears, showing no participation.
• Gaia-X Community – Members Directory other 24. September 2026
  Official Gaia-X hub listing organisations participating in the Gaia-X initiative across Europe.
  Relevance: Authoritative register of Gaia-X participants; Atlas Cloud (Iceland) does not appear, indicating no Gaia-X membership.

Selected answer: Bold ambition and dedicated means Value 125 SEAL 4

Notes: Startup entirely built on green/digital-sovereignty goals with dedicated means (hydro DCs, ISO 27001), but no measured EU-level achievements yet.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Existing source showing Atlas's green hydro model and sovereignty mission aligning with EU green and digital goals.
• Climate Neutral Data Centre Pact - Self Regulatory Initiative other 24. September 2026
  European cloud/data centre industry pact, in cooperation with the European Commission, for climate-neutral data centres by 2030.
  Relevance: Benchmarks the EU green objective; Atlas's hydro-powered Icelandic infrastructure matches its carbon-free-energy aims.
• European Commission — Cloud Computing Policy other 4. September 2026
  Official EU policy page outlining digital strategy targets: 75% cloud adoption by 2030, climate-neutral data centres, CADA, and open source investments.
  Relevance: Defines the EU-level digital, green and industrial objectives against which the provider's alignment is assessed.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 93 SEAL 2

Notes: Own Icelandic infra on open standards (K8s, S3, IaC), no vendor lock-in; small team can switch suppliers or internalise key functions if cut off.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Self-operated infra on open standards (Kubernetes, S3 API, Terraform/Ansible) with 'no vendor lock-in' — key to internalising functions or switching suppliers.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Independently confirms Atlas self-operates Icelandic infrastructure without foreign hyperscaler dependence, implying supplier-switch capacity at cut-off.
• European Commission — Cloud Sovereignty Framework Implementation Guidance other 2. September 2026
  Official EU implementation guidance defining SOV-5: Supply Chain Sovereignty criteria including geographic origin of hardware, jurisdiction of embedded firmware code, and supplier auditability.
  Relevance: Defines the SOV-1 criterion: sustaining secure operations if vendor support is withdrawn; option 4 represents the mid-level resilience outcome.

Selected answer: 1. Non-EU only Value 0 SEAL 1

Notes: Atlas Cloud ehf. is Icelandic; ops & contracts governed by Icelandic law. Iceland is EEA, not an EU member state → non-EU jurisdiction only.

Evidence

• Atlas – Green Cloud Computing in Iceland other 25. September 2026
  Official Atlas Cloud ehf. site: infrastructure hosted exclusively in Iceland and complying with Icelandic law; Icelandic ToS version prevails.
  Relevance: Provider's own site confirms operations and contracts fall under Icelandic law, a non-EU national legal system.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Independently confirms Icelandic incorporation and Iceland-only operations, supporting non-EU jurisdiction classification.
• Data Protection in Iceland – DLA Piper other 25. September 2026
  Country guide: Iceland implements GDPR via EEA Joint Committee Decision 154/2018 and its own Act No. 90/2018, enforced by Persónuvernd.
  Relevance: Clarifies Iceland is a non-EU EEA jurisdiction whose national law governs providers, with GDPR applied via EEA Agreement.

Selected answer: Mitigation clauses, exposure remains Value 41 SEAL 1

Notes: Privately-owned Icelandic provider, no US nexus limits CLOUD Act reach; protections are contractual (Icelandic law, GDPR); exposure remains, no verified immunity.

Evidence

• Data Protection in Iceland – DLA Piper other 25. September 2026
  Country guide: Iceland implements GDPR via EEA Joint Committee Decision 154/2018 and its own Act No. 90/2018, enforced by Persónuvernd.
  Relevance: Icelandic law limits non-EU (e.g., US) authority access to MLAT/international-agreement channels - mitigation, not elimination, of extraterritorial exposure.
• Mitigating the Risk of US Surveillance for Public Sector Services in the Cloud other 4. September 2026
  Academic article (Internet Policy Review) analyzing how MLATs and Swedish secrecy law interact with foreign data access requests.
  Relevance: Documents persistent cross-border reach of US laws over cloud data; foreign-law exposure cannot be deemed unenforceable without verified immunity.
• Terms of Service - Atlas Cloud other 25. September 2026
  Atlas ToS: governed by Icelandic law, Icelandic version prevails, GDPR DPA required, data stored in Iceland.
  Relevance: Shows Atlas's safeguards are contractual (Icelandic-law terms, DPA), not shield structures or verified immunity, so residual exposure remains.

Selected answer: 2. Non-EU authorities can compel access to data or systems without customers being notified, in specific cases Value 41 SEAL 1

Notes: Icelandic law allows court-ordered/data-retention access, incl. MLAT for non-EEA states, in specific cases; customer notification not guaranteed in all cases.

Evidence

• Data Protection in Iceland – DLA Piper other 25. September 2026
  Country guide: Iceland implements GDPR via EEA Joint Committee Decision 154/2018 and its own Act No. 90/2018, enforced by Persónuvernd.
  Relevance: Confirms foreign (non-EU/EEA) authority demands (GDPR Art. 48) are only enforceable via MLAT/international agreement; legal access channels exist in specific cases.
• Iceland Privacy and Surveillance Laws — CodeMail Privacy Law Directory other 25. September 2026
  Directory of Iceland's privacy/surveillance laws, data retention, and foreign authority cooperation channels.
  Relevance: Maps channels for non-EU authorities (Budapest Convention MLAT, Europol, Schengen, Tier-B intel cooperation); court-ordered access limited to police; notification not guaranteed.
• Terms of Service - Atlas Cloud other 25. September 2026
  Atlas ToS: governed by Icelandic law, Icelandic version prevails, GDPR DPA required, data stored in Iceland.
  Relevance: Shows contractual/legal pathway: data stored in Iceland under Icelandic law; provider engages authorities rather than blanket-rejecting requests; no all-case notification promise.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: Privately owned Icelandic provider, no US parent or listing; data and operations stay in Iceland under Icelandic law, so ITAR/EAR limits towards EU MSs/IOs do not apply.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Shows no US parent or corporate nexus through which US export-control obligations could flow to the offer; jurisdiction remains Icelandic/EEA only.
• European Commission — Cloud Sovereignty Framework Implementation Guidance other 2. September 2026
  Official EU implementation guidance defining SOV-5: Supply Chain Sovereignty criteria including geographic origin of hardware, jurisdiction of embedded firmware code, and supplier auditability.
  Relevance: Primary source for the assessed criterion: applicability of international regimes (ITAR/EAR-type) that may restrict usage or transfer is a SOV-2 factor.
• Why U.S. Export Control Laws Are Relevant to Non-U.S. Companies other 25. September 2026
  Law-firm explainer on ITAR/EAR extraterritorial reach: binds US-origin items, US persons and re-exports; explains de minimis/compliance triggers.
  Relevance: ITAR/EAR apply only via a US nexus (US-origin items/US persons); with none, Atlas Cloud's offer faces no transfer limits towards EU MSs or IOs.

Selected answer: 2. Mostly outside the EU Value 41 SEAL 4

Notes: Atlas Cloud ehf is based in Reykjavik, Iceland (EEA). IP creation and registration occur under Icelandic law, outside the EU.

Evidence

• Atlas – LinkedIn Company Page other 24. September 2026
  LinkedIn company page: Atlas, Reykjavík, privately held, founded 2025, 2-10 employees, Iceland sovereignty mission.
  Relevance: Verifies company registration and operational base in Reykjavik.
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Primary source confirming operational and IP jurisdiction is Iceland (EEA), not the EU.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Independent verification of the provider's Reykjavik headquarters and legal entity.

Selected answer: EU law with exceptions Value 125 SEAL 4

Notes: Iceland's IP law mirrors the EU acquis via the EEA, but Iceland is not an EU member; Atlas's IP is held and enforced under Icelandic law.

Evidence

• Iceland – Protecting Intellectual Property (Trade.gov) other 25. September 2026
  US Commerce guide: IP in Iceland is registered and enforced locally; Iceland adheres to EEA, EPO, PCT and Madrid Protocol.
  Relevance: IP rights are private rights enforced under Icelandic law via ISIPO/EPO channels, not directly through EU courts — EU law with exceptions.
• Screening Report: Iceland – Intellectual Property Law (Chapter 7) other 25. September 2026
  Official EC screening of Iceland's IP law against the EU acquis, harmonised via the EEA Agreement (Annex XVII).
  Relevance: Confirms Iceland transposes EU IP directives (copyright, trademark, patent, design) via EEA yet is not an EU member — EU law with exceptions.
• Terms of Service - Atlas Cloud other 25. September 2026
  Atlas ToS: governed by Icelandic law, Icelandic version prevails, GDPR DPA required, data stored in Iceland.
  Relevance: Provider contracts are governed by Icelandic law, anchoring Atlas's IP holdings and enforcement in Iceland's EEA-aligned jurisdiction.

Selected answer: 2. Primarily the provider but not exclusively Value 50 SEAL 1

Notes: Atlas encrypts data under its own ISO 27001 key-management regime; no BYOK/customer-held keys documented, so customers lack exclusive control.

Evidence

• Atlas Trust Center other 26. September 2026
  Official Atlas (Iceland) security portal: ISO 27001:2022, bug bounty, Borealis Tier 3 datacenter, digital sovereignty claims.
  Relevance: Shows provider-side security & cryptography management; no evidence of customer-managed keys (BYOK), so key control stays with the provider.
• Atlas Trust Center - Security Controls other 26. September 2026
  Lists Atlas security controls incl. 'Use of cryptography': cryptographic key management defined and implemented by the provider.
  Relevance: Key management is a provider-implemented control (ISO 27001 A.8.24); no customer-held key options or read-proof scheme documented.
• Terms of Service - Atlas Cloud other 25. September 2026
  Atlas ToS: governed by Icelandic law, Icelandic version prevails, GDPR DPA required, data stored in Iceland.
  Relevance: Contractual terms contain no customer-managed encryption key or BYOK provisions, confirming key custody remains primarily with the provider.

Selected answer: 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) Value 100 SEAL 2

Notes: ISO 27001-certified ISMS implies vendor-side logging, but no customer-facing real-time access log visibility or AI usage auditability is documented.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Full service portfolio and sovereignty claims contain no transparency or audit-log features, indicating logging is basic, vendor-side, and not customer-visible in real time.
• Atlas Trust Center other 26. September 2026
  Atlas Trust Center: ISO 27001:2022 certified, bug bounty, Tier 3 Borealis data centre in Iceland.
  Relevance: Showcases the certified ISMS security posture; monitoring and audit appear as internal vendor processes, with no customer-facing real-time access-log transparency offering documented.
• Atlas Trust Center - Security Controls other 26. September 2026
  Lists Atlas security controls incl. 'Use of cryptography': cryptographic key management defined and implemented by the provider.
  Relevance: Confirms access logging is a vendor-managed internal control under ISO 27001; no evidence of customer-controlled or real-time log visibility or AI model usage auditing.

Selected answer: 3. Internal validation based on policies - no proof of validation left Value 100 SEAL 1

Notes: DPA commits to irreversible removal from all copies within 30 days, but by internal policy only; no independent verification or erasure proof.

Evidence

• Atlas Trust Center other 26. September 2026
  Official Atlas (Iceland) security portal: ISO 27001:2022, bug bounty, Borealis Tier 3 datacenter, digital sovereignty claims.
  Relevance: Confirms certified ISMS context but lists no independent erasure verification or proof-of-deletion mechanism.
• Atlas Trust Center - Security Controls other 26. September 2026
  Lists Atlas security controls incl. 'Use of cryptography': cryptographic key management defined and implemented by the provider.
  Relevance: Shows deletion handled as internal ISMS policy control; no deletion certificates or independent verification evidence offered.
• Data Processing Agreement - Atlas Cloud other 26. September 2026
  Atlas GDPR Art. 28 DPA defining processor duties incl. deletion of data and residual copies.
  Relevance: States deleted data is irreversibly removed from all copies within 30 days - a policy commitment with no verifiable erasure proof offered.

Selected answer: 5. All data exclusively in the EU with no third-country fallback Value 200 SEAL 4

Notes: All data and processing stay exclusively in Iceland (EEA, Borealis Tier 3 DC, Reykjavík); no third-country fallback.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: States all storage and processing occur solely in Iceland (EEA) under Icelandic law, supporting the strictest data-location option.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Third-party verification of one exclusively Icelandic location; no other regions or third-country data processing documented.
• Keeping digital data within the jurisdiction – Atlas blog other 26. September 2026
  Atlas blog on its 2025 launch: data stored and processed in Iceland so no foreign government or party can access it.
  Relevance: Explicitly confirms confinement of data processing to Icelandic jurisdiction with no reliance on foreign systems or third countries.

Selected answer: Mixed Control with alternatives: Auditable or open source AI, foreign chips Value 100 SEAL 2

Notes: No managed AI services offered; open VM/K8s platform allows customer-run open-source models, but no EU AI stack; any accelerators would be foreign.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms Atlas' portfolio is VMs/Kubernetes/storage/backups only — no managed AI services, so no EU-controlled AI models or data pipelines.
• Atlas Cloud — 400+ AI Models, One API other 26. September 2026
  US AI inference platform (Menlo Park) serving 400+ models incl. DeepSeek/Qwen on Nvidia GPUs; unrelated namesake of Atlas Cloud ehf.
  Relevance: Disambiguates the well-known US 'Atlas Cloud' AI platform from the Icelandic provider, preventing misattribution of foreign AI services.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Third-party enumeration of services confirms absence of AI offerings, supporting only an open/auditable-stack posture rather than EU-led AI.

Selected answer: 3. Standard documented methods for data export are available Value 83 SEAL 4

Notes: Open standards (Kubernetes, S3 API, Terraform) with no vendor lock-in claim; documented standard methods, but no formal migration services offered.

Evidence

• Atlas – Green Cloud Computing in Iceland other 25. September 2026
  Official Atlas Cloud ehf. site: infrastructure hosted exclusively in Iceland and complying with Icelandic law; Icelandic ToS version prevails.
  Relevance: Provider's own claims of no vendor lock-in via open standards (Kubernetes, S3-compatible APIs, Terraform/Ansible) directly evidence portability.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Third-party corroboration of free egress and standard APIs/tools that ease exit, migration, and integration without lock-in.
• Digital Sovereignty – Atlas Cloud other 26. September 2026
  Atlas sovereignty roadmap making 'no vendor lock-in' and full data-flow control a core maturity goal (100/100).
  Relevance: Explicitly positions absence of vendor lock-in as a sovereignty pillar, directly relevant to portability and interoperability assessment.

Selected answer: 5. The entire technology stack is managed and supported by a fully EU-based team Value 167 SEAL 4

Notes: Atlas Cloud runs its whole platform with a small fully Iceland-based team; infrastructure exclusively in Iceland, no foreign ops/vendor involvement.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Shows all operations, engineering and management staff are Iceland-based, with no non-EU teams involved in running or supporting the cloud platform.
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Atlas operates its own stack and support from Iceland; infrastructure is hosted exclusively in Iceland, indicating operation without foreign vendor ops teams.
• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Third-party confirmation that a small privately owned Icelandic company operates the entire platform itself, with no foreign parent or outsourced operations.

Selected answer: All EU staff Value 125 SEAL 3

Notes: Atlas's small team (2-10) is fully Iceland-based (EEA); no foreign staff or offshore escalation found, but tiny local pool limits sustainment.

Evidence

• 10 Most In-Demand Skills in Iceland for 2026 other 26. September 2026
  Analysis of Iceland's 2026 skills gaps: 2,000+ unfilled tech roles, cloud and cybersecurity shortages, permit fast-tracking.
  Relevance: Documents Iceland's scarce cloud/IT talent pool, highlighting a continuity risk for sustaining the service despite its fully local staff.
• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: All named staff (CEO, CTO, specialists) and advisors are Iceland-based, indicating operations run on local EEA personnel with no offshore escalation path evidenced.
• Atlas – LinkedIn Company Page other 24. September 2026
  LinkedIn company page: Atlas, Reykjavík, privately held, founded 2025, 2-10 employees, Iceland sovereignty mission.
  Relevance: Confirms the company's entire workforce (2-10 people) is Reykjavik-based, so all staff operating the service are local, though the pool is very small.

Selected answer: 4. All support staff are located within the EU Value 125 SEAL 3

Notes: Small all-Icelandic Reykjavík team; support via Icelandic help email/phone; governed by Icelandic (EEA) law. No evidence of security clearances.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Shows the entire small team is Iceland-based, supporting that all support staff reside within the EEA with no non-EU team.
• Atlas Cloud Documentation – Support other 26. September 2026
  Atlas Cloud's official documentation portal; lists the customer support channel as help@atlascloud.is, run by the Icelandic entity.
  Relevance: Confirms the primary operational support channel is delivered through the Icelandic entity from within the EEA.
• Terms of Service - Atlas Cloud other 25. September 2026
  Atlas ToS: governed by Icelandic law, Icelandic version prevails, GDPR DPA required, data stored in Iceland.
  Relevance: Assures support and operations are subject exclusively to Icelandic (EEA-aligned GDPR) law, not foreign jurisdictions.

Selected answer: 4. EU-only primary repositories - All primary documentation and knowledge repositories are stored in the EU (no routine non-EU storage/processing) Value 125 SEAL 4

Notes: All documentation, repos, and know-how stored in Iceland (EU/EEA). Open-source stack and IaC tools enable autonomy. No explicit evidence of EU-only staff access restrictions for Option 5.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms all infrastructure and documentation hosted in Iceland (EU/EEA), open-source software enables source code access, and IaC tools (Terraform/Ansible) support operational know-how transfer.
• Atlas Cloud Documentation other 26. September 2026
  Atlas Cloud's technical documentation portal with getting started guides, tutorials, and API references for their cloud platform services.
  Relevance: Shows availability of comprehensive technical documentation hosted on Atlas's own Iceland-based infrastructure, supporting long-term operational autonomy and knowledge transfer.
• Digital Sovereignty – Atlas Cloud other 26. September 2026
  Atlas Cloud's digital sovereignty journey page outlining their commitment to keeping data and systems within Iceland's jurisdiction with no foreign access.
  Relevance: Demonstrates Atlas's policy of storing all documentation and operational knowledge domestically in Iceland (EU/EEA) with no routine non-EU storage or processing.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 125 SEAL 3

Notes: Open-source CloudStack platform avoids vendor lock-in; critical suppliers (Borealis DC, Nova) are EU/EEA-based with local alternatives available in Iceland.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Identifies all critical subcontractors/suppliers as Icelandic/EU-EEA entities and confirms open-source platform use enabling supplier independence and internalisation.
• Iceland's Borealis Acquires Finnish Data Center — DCD other 26. September 2026
  Data Center Dynamics article on Borealis Data Center ownership: founded in Iceland (2014), acquired by Vauban Infrastructure Partners (Paris, France) in 2021, operating in Iceland and Finland.
  Relevance: Confirms Atlas's primary data center supplier is headquartered in Iceland with EU-based majority ownership — all within EU/EEA jurisdiction, no non-European control.
• Nova (Iceland) — Wikipedia other 26. September 2026
  Wikipedia article on Nova, Icelandic telecommunications company listed on Nasdaq Iceland, operating 3G/4G/5G and FTTH networks, headquartered in Reykjavík.
  Relevance: Confirms Atlas's connectivity partner Nova is Icelandic-domiciled and EU/EEA-regulated, with alternative Icelandic telecoms available if needed.

Selected answer: Partial disclosure Value 35 SEAL 1

Notes: Atlas discloses partners (Borealis, Nova) and subprocessors but not hardware component origins or geographic provenance of physical parts.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Site discloses partners and software stack but provides no information on hardware manufacturers or geographic origin of physical components, indicating partial disclosure.
• Atlas Trust Center other 26. September 2026
  Atlas Trust Center: ISO 27001:2022 certified, bug bounty, Tier 3 Borealis data centre in Iceland.
  Relevance: Shows Atlas discloses some supply chain elements (facility, SaaS subprocessors) but omits hardware component origins or physical part provenance — supporting partial disclosure.
• Borealis Data Center — Insights other 26. September 2026
  Borealis DC partnerships page: accredited Supermicro Service Partner, collaborations with IBM, Sardina Systems, Vespertec; OCP Ready certified.
  Relevance: Reveals Borealis hardware ecosystem (Supermicro, IBM) but Atlas does not publicly confirm which hardware it uses, underscoring lack of full transparency on component origins.

Selected answer: Foreign origin, partial disclosure Value 35 SEAL 1

Notes: Hardware sourced from non-EU OEMs (Supermicro US/Taiwan, Dell China/Taiwan). Partial disclosure via Borealis partner list. No evidence of EU audit rights.

Evidence

• Atlas Cloud: Review, Pricing & Alternatives other 24. September 2026
  Third-party overview of Atlas Cloud: Icelandic sovereign cloud provider run by Atlas Cloud ehf, hosted in Iceland, ISO 27001, GDPR compliant.
  Relevance: Confirms Atlas Cloud uses Borealis Data Center in Iceland and is built on Apache CloudStack (US-origin open-source). Hardware sourcing is via Borealis partners, all non-EU OEMs.
• Borealis Data Center – Official Website other 26. September 2026
  Borealis Data Center operates Icelandic data centers hosting Atlas Cloud. Partners with Supermicro, Dell, Nvidia — all non-EU hardware manufacturers.
  Relevance: Identifies hardware OEMs at Atlas Cloud's hosting facility. Supermicro (US/Taiwan), Dell (China/Taiwan/Vietnam), and Nvidia (US/Taiwan) are all non-EU origin, confirming foreign hardware sourcing.
• Supermicro – About Us (Manufacturing Footprint) other 26. September 2026
  Supermicro's official page detailing global manufacturing: US (San Jose), Taiwan, Netherlands (integration only), Malaysia. Majority of servers produced in US and Taiwan.
  Relevance: Confirms Supermicro hardware used at Borealis is manufactured in US and Taiwan, not in EU. Netherlands facility is only system integration/logistics, not full manufacturing.

Selected answer: Partial disclosure Value 35 SEAL 4

Notes: Atlas discloses data center partners but not detailed hardware/firmware provenance. Supplier Supermicro offers attestation but is non-EU with known firmware gaps.

Evidence

• Broken Trust: Fixed Supermicro BMC Bug Gains a New Life | Binarly other 26. September 2026
  Security research revealing two new Supermicro BMC firmware vulnerabilities (CVE-2025-7937, CVE-2025-6198) that bypass Root of Trust, enabling malicious firmware updates and persistent compromise.
  Relevance: Demonstrates that Supermicro's firmware transparency and attestation features have real-world gaps, undermining provenance assurances for Atlas's hardware supply chain and reinforcing partial disclosure assessment.
• Digital Sovereignty – Atlas Cloud other 26. September 2026
  Atlas Cloud's digital sovereignty journey page outlining their commitment to keeping data and systems within Iceland's jurisdiction with no foreign access.
  Relevance: Shows Atlas's sovereignty framework addresses data and infrastructure control but omits disclosure of hardware component origins and firmware provenance, indicating partial disclosure on supply chain sovereignty.
• Security Features Descriptions | Supermicro other 26. September 2026
  Supermicro's official page documenting firmware security features including Silicon Root of Trust, cryptographically signed firmware (RSA4K/SHA512), and remote attestation for supply chain integrity from manufacturing to deployment.
  Relevance: Supermicro is Atlas's hardware supplier (per existing evidence). This page shows partial transparency on firmware provenance via attestation, but manufacturing is US/Taiwan-based (non-EU), not EU-certified.

Selected answer: 3. Core and essential parts of the software are designed and maintained by EU teams Value 71 SEAL 3

Notes: Atlas Cloud's own platform is built by an Icelandic (EEA) team, but relies on globally-developed open-source software (Kubernetes, Postgres) for core infrastructure.

Evidence

• About Us – Atlas other 24. September 2026
  Company page with the Icelandic-led team, chairman (Óli) and advisory board from Icelandic firms Míla and Nova.
  Relevance: Confirms Atlas Cloud's own platform software is architected and programmed by an Icelandic (EEA) team, supporting EU/EEA origin of core software components.
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Reveals Atlas builds on globally-developed open-source software (e.g. Kubernetes, Postgres), meaning core infrastructure software is not exclusively EU-developed.
• Digital Sovereignty – Atlas Cloud other 26. September 2026
  Atlas sovereignty roadmap making 'no vendor lock-in' and full data-flow control a core maturity goal (100/100).
  Relevance: Shows Atlas's commitment to sovereignty and transparency about its open-source foundation, but does not claim exclusive EU software development across the full stack.

Selected answer: 5. EU control and EU policy gates - As (4), plus EU-based compliance/security gates enforced in the pipeline (e.g., signing under your control, vulnerability checks, segregation of duties, auditable approvals) Value 143 SEAL 4

Notes: Iceland-based (EEA), privately owned. ISO 27001 certified with security gates: Socket.dev, Semgrep, fencer.dev for supply chain monitoring, vulnerability checks, and auditable approvals.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms EU/EEA jurisdiction over all operations, privately owned, no non-EU parent — establishing EU control and execution of software packaging, distribution, and updates.
• Atlas ISO 27001 Certification Blog other 26. September 2026
  Blog post detailing Atlas Cloud's ISO 27001:2022 certification process, including use of Semgrep (static analysis), Socket.dev (supply chain monitoring), fencer.dev (vulnerability scanning), and Wazuh (HIDS).
  Relevance: Directly evidences EU-based compliance/security gates in the pipeline: vulnerability checks, supply chain package risk monitoring, and static code analysis under Icelandic control.
• Atlas Trust Center other 26. September 2026
  Atlas Cloud's Trust Center detailing ISO 27001:2022 controls across 5 categories (116 controls total), bug bounty with Defend Iceland, subprocessor transparency, and security contact.
  Relevance: Shows EU-based security controls, auditable procedures, and segregation of duties under Icelandic jurisdiction — key for assessing software packaging and update governance.

Selected answer: Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented Value 71 SEAL 2

Notes: Atlas relies on non-EU hardware vendors (Supermicro, Dell, Nvidia) for critical infrastructure at Borealis DC; these dependencies are not documented on their website. Facility is EU-owned.

Evidence

• Borealis Data Center Now Supports Supermicro for Comprehensive Post-Sales Services Enhancing its AI & HPC Offering other 26. September 2026
  Borealis Data Center's official press release announcing its accredited Supermicro Service Partner status, detailing post-sales support for Supermicro equipment at its Iceland and Finland sites.
  Relevance: Documents non-EU hardware vendor (Supermicro, US/Taiwan) dependency at Borealis Data Center where Atlas Cloud is hosted, directly relevant to single point of dependency on non-EU vendors in critical services.
• Fluidstack Partners with Nvidia, Borealis, and Dell for Exascale GPU Clusters other 26. September 2026
  Data Center Dynamics article reporting Fluidstack's partnership with Nvidia, Dell, and Borealis Data Center to deploy exascale GPU clusters using Dell PowerEdge servers with Nvidia GPUs in Iceland.
  Relevance: Confirms Borealis Data Center uses Dell (US) and Nvidia (US) hardware, identifying additional non-EU vendor dependencies in critical infrastructure services for Atlas Cloud's hosting environment.
• Vauban Closes a $148M Debt Financing for Borealis Data Center other 26. September 2026
  Vauban Infrastructure Partners' official press release confirming 92.2% ownership of Borealis Data Center, acquired in 2021 through its Core Infrastructure Fund III, with operations in Iceland and Finland.
  Relevance: Confirms Borealis Data Center is European-owned (Vauban, Paris), mitigating facility dependency but highlighting that hardware vendors remain non-EU, supporting the assessment of few non-EU vendor dependencies.

Selected answer: Critical suppliers and subcontractors can be audited Value 71 SEAL 2

Notes: ISO 27001 requires supplier audit clauses for critical suppliers; DPA grants customer audit rights over Atlas. No evidence of full-chain audit coverage for all tiers.

Evidence

• Atlas Cloud — Certification Path other 26. September 2026
  Atlas's compliance roadmap showing ISO 27001:2022 certification (Aug 2026) with 93 Annex A controls, and future plans for ISO 27017/27018, EU CRA, and SOC 2.
  Relevance: ISO 27001 Annex A 5.19-5.23 mandates supplier management with risk-based due diligence and audit clauses, establishing audit rights with critical suppliers.
• Data Processing Agreement - Atlas Cloud other 26. September 2026
  Atlas GDPR Art. 28 DPA defining processor duties incl. deletion of data and residual copies.
  Relevance: Directly addresses audit rights granted to customers and sub-processor transparency mechanisms, key for assessing supply chain audit visibility.
• ISO 27001:2022 Annex A.5 — Supplier Management Controls other 3. September 2026
  Practical guidance on ISO 27001:2022 controls A.5.19–A.5.23 covering supplier relationships, security agreements, ICT supply chain, monitoring, and cloud service security including audit rights.
  Relevance: Explains the ISO 27001 supplier audit requirements Atlas must implement, showing scope is risk-based (critical suppliers) rather than covering all tiers.

Selected answer: 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation Value 150 SEAL 3

Notes: Built on open-source Apache CloudStack with S3-compatible, OCCI, and native APIs. Core IaaS follows open standards, though some service-layer specifics may be vendor-specific.

Evidence

• Apache CloudStack — Official Website other 3. September 2026
  Official Apache CloudStack site describing it as an open-source IaaS cloud computing platform used by MSPs, telcos, and cloud providers with multi-hypervisor support and AWS API compatibility.
  Relevance: Atlas Cloud is built on CloudStack; its APIs are open, documented, and standards-aligned (OCCI, AWS-compatible), confirming broadly compatible open interfaces.
• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms S3 API compatibility, IaC tool support (Terraform/Ansible), CLI/API access, and explicit no-vendor-lock-in stance using open-source solutions.
• Atlas Cloud Documentation – Support other 26. September 2026
  Atlas Cloud's official documentation portal; lists the customer support channel as help@atlascloud.is, run by the Icelandic entity.
  Relevance: Provides API access documentation, CLI tooling, and tutorials demonstrating S3-compatible API usage and standard interface patterns.

Selected answer: 3. Partial core adoption - Open standards are used and documented for some core services, while other core services remain proprietary/vendor-specific Value 100 SEAL 2

Notes: Open standards used for core services (S3, Kubernetes, CloudStack, Terraform) but no formal policy; some services like SaaS backups and managed SQL lack open standards coverage.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Shows core services built on open standards (S3 API, Kubernetes, Terraform) but no formal governance policy mandating open standards across all services.
• Atlas Cloud GitHub Organization (RunAtlas-is) other 26. September 2026
  Atlas Cloud's GitHub with public repos confirming Apache CloudStack foundation, K3s for Kubernetes, and Terraform provider — all open-source technologies.
  Relevance: Confirms core infrastructure uses open-source/open standards (Apache CloudStack, K3s, Terraform) but repos are limited to infrastructure tooling, not a formal open standards policy.
• Digital Sovereignty – Atlas Cloud other 26. September 2026
  Atlas Cloud's digital sovereignty journey page outlining their commitment to keeping data and systems within Iceland's jurisdiction with no foreign access.
  Relevance: Demonstrates open standards adoption as a design philosophy but not as a formal, documented policy mandating compliance across all core services.

Selected answer: 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover Value 100 SEAL 3

Notes: Atlas Cloud publishes open-source repos (MIT/Apache-2.0) but governance is centralized under a single private company (Atlas Cloud ehf.), limiting strategic autonomy.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms Atlas Cloud builds on open-source technology and explicitly avoids vendor lock-in, but does not indicate independent or EU-based governance of their software stack.
• Atlas Cloud GitHub Organization (RunAtlas-is) other 26. September 2026
  Atlas Cloud's GitHub with public repos confirming Apache CloudStack foundation, K3s for Kubernetes, and Terraform provider — all open-source technologies.
  Relevance: Shows Atlas Cloud's open-source code is available under standard OSI licenses permitting modification and redistribution, but all repos are governed centrally by a single private company.
• Digital Sovereignty – Atlas Cloud other 26. September 2026
  Atlas sovereignty roadmap making 'no vendor lock-in' and full data-flow control a core maturity goal (100/100).
  Relevance: Demonstrates Atlas Cloud's commitment to open-source principles and sovereignty, but governance of their own software remains centralized under a private Icelandic company.

Selected answer: Some public insight exists (all) Value 100 SEAL 3

Notes: Public insight via website, GitHub repos (CloudStack, K3s, Terraform), and Trust Center, but no large corpus of detailed architectural docs or data flow diagrams.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Provides high-level public insight into service architecture, tech choices, and open-source stack, but lacks detailed architectural documentation or data flow diagrams.
• Atlas Cloud GitHub Organization (RunAtlas-is) other 26. September 2026
  Atlas Cloud's GitHub with public repos confirming Apache CloudStack foundation, K3s for Kubernetes, and Terraform provider — all open-source technologies.
  Relevance: Publicly exposes the underlying technology stack and infrastructure-as-code, offering transparency into service dependencies, but limited to tooling repos without full architecture docs.
• Atlas Trust Center other 26. September 2026
  Atlas Cloud's Trust Center detailing ISO 27001:2022 controls across 5 categories (116 controls total), bug bounty with Defend Iceland, subprocessor transparency, and security contact.
  Relevance: Provides public insight into security architecture, controls, and compliance posture, contributing to service architecture transparency but not full design documentation.

Selected answer: EU-hosted, foreign stack Value 50 SEAL 3

Notes: Atlas operates in Iceland (EU/EEA) but uses US-designed Supermicro hardware with Intel/AMD processors. No EU processor IP, accelerators, or HPC software ecosystem.

Evidence

• Borealis Data Center Now Supports Supermicro for Comprehensive Post-Sales Services Enhancing its AI & HPC Offering other 26. September 2026
  Borealis Data Center's official press release announcing its accredited Supermicro Service Partner status, detailing post-sales support for Supermicro equipment at its Iceland and Finland sites.
  Relevance: Links Atlas's Iceland-hosted infrastructure directly to Supermicro (US) hardware, confirming the foreign stack in an EU-hosted environment.
• IHPC | National Competence Center for HPC & AI in Iceland other 26. September 2026
  Iceland's HPC competence center (EuroCC). Includes testimonial from SME AtlasCloud about receiving HPC support, indicating Atlas is an HPC consumer, not provider.
  Relevance: Shows Atlas Cloud lacks independent HPC capabilities and relies on national/EU HPC resources, confirming no European HPC processor or accelerator independence.
• Supermicro – About Us (Manufacturing Footprint) other 26. September 2026
  Supermicro's official page detailing global manufacturing: US (San Jose), Taiwan, Netherlands (integration only), Malaysia. Majority of servers produced in US and Taiwan.
  Relevance: Establishes that Atlas Cloud's hardware stack is US-designed with no EU processor IP, confirming foreign technology dependence in HPC infrastructure.

Selected answer: ELA1 Value 35 SEAL 1

Notes: Atlas holds ISO 27001:2022 only; ISO 27017/27018, SOC 2, and EU CRA are planned but not yet achieved. Entry-level certification attainment.

Evidence

• Atlas Cloud — Certification Path other 26. September 2026
  Atlas's compliance roadmap showing ISO 27001:2022 certification (Aug 2026) with 93 Annex A controls, and future plans for ISO 27017/27018, EU CRA, and SOC 2.
  Relevance: Directly shows only ISO 27001 attained while cloud-specific, privacy, and SOC 2 certifications remain future goals, confirming entry-level certification status.
• Atlas ISO 27001 Certification Blog other 26. September 2026
  Blog post detailing Atlas Cloud's ISO 27001:2022 certification process, including use of Semgrep (static analysis), Socket.dev (supply chain monitoring), fencer.dev (vulnerability scanning), and Wazuh (HIDS).
  Relevance: Confirms ISO 27001 as the sole certification attained; no mention of additional EU-specific or high-assurance certifications like C5 or Common Criteria EAL.
• Atlas Trust Center other 26. September 2026
  Official Atlas (Iceland) security portal: ISO 27001:2022, bug bounty, Borealis Tier 3 datacenter, digital sovereignty claims.
  Relevance: Trust portal shows only ISO 27001 as active certification; no evidence of C5, FedRAMP, ENS, or Common Criteria EAL certifications currently held.

Selected answer: 3. Moderate compliance to some well-know EU Regulations (controls exist but gaps remain; compliance not fully demonstrated) Value 71 SEAL 4

Notes: GDPR covered via Iceland's EEA implementation and ISO 27001:2022 achieved, but NIS2/DORA not yet transposed in Iceland; gaps remain for key EU frameworks.

Evidence

• Atlas Cloud — Certification Path other 26. September 2026
  Atlas's compliance roadmap showing ISO 27001:2022 certification (Aug 2026) with 93 Annex A controls, and future plans for ISO 27017/27018, EU CRA, and SOC 2.
  Relevance: Demonstrates achieved ISO 27001 certification but no formal NIS2, DORA, or GDPR-specific audit; planned certifications show awareness but gaps remain for EU regulatory compliance.
• Atlas ISO 27001 Certification Blog other 26. September 2026
  Blog post detailing Atlas Cloud's ISO 27001:2022 certification process, including use of Semgrep (static analysis), Socket.dev (supply chain monitoring), fencer.dev (vulnerability scanning), and Wazuh (HIDS).
  Relevance: Shows independently audited security controls (ISO 27001) providing a baseline for GDPR and NIS2 alignment, but ISO 27001 alone does not constitute formal EU regulatory compliance for NIS2 or DORA.
• NIS2 Directive Regulations and Implementation in Iceland other 26. September 2026
  Overview of Iceland's NIS2 implementation journey through the EEA process, with projected compliance deadlines extending to 2028.
  Relevance: Explains why Atlas Cloud cannot yet demonstrate NIS2 compliance: Iceland has not transposed NIS2 into national law, with entry into force projected for July 2027 and compliance deadlines in 2028.

Selected answer: 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources Value 107 SEAL 3

Notes: Atlas Cloud's SOC, incident response (Syndis, ATVIK), and CERT-IS all operate in Iceland (EU/EEA). No ENISA framework participation found; threat intel sourced locally/EU.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Demonstrates all security operations and incident response partners are Icelandic/EU-based with no escalation to non-EU teams.
• Atlas ISO 27001 Certification Blog other 26. September 2026
  Blog post detailing Atlas Cloud's ISO 27001:2022 certification process, including use of Semgrep (static analysis), Socket.dev (supply chain monitoring), fencer.dev (vulnerability scanning), and Wazuh (HIDS).
  Relevance: Shows self-hosted security operations tooling and incident handling capabilities operating within Iceland/EU jurisdiction.
• Atlas Trust Center other 26. September 2026
  Official Atlas (Iceland) security portal: ISO 27001:2022, bug bounty, Borealis Tier 3 datacenter, digital sovereignty claims.
  Relevance: Confirms security operations framework and incident handling controls operate within Iceland/EU jurisdiction exclusively.

Selected answer: 3. Customers have access to a basic portal for monitoring Value 71 SEAL 1

Notes: Atlas offers customer dashboards for usage monitoring but security monitoring (Wazuh/XDR) is internal; no evidence of direct log access or immutable logs.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Website mentions 'Monitor your usage with dashboards,' indicating a basic customer portal for usage monitoring but not full security log/alert access.
• Atlas ISO 27001 Certification Blog other 26. September 2026
  Blog post detailing Atlas Cloud's ISO 27001:2022 certification process, including use of Semgrep (static analysis), Socket.dev (supply chain monitoring), fencer.dev (vulnerability scanning), and Wazuh (HIDS).
  Relevance: Confirms Wazuh runs on Atlas's own infrastructure for internal security monitoring — not customer-facing. No mention of customer access to security logs or alerts.
• Two Security Reports and How We Responded other 26. September 2026
  Blog post detailing two access-control vulnerability reports via Defend Iceland, customer access roles (ReadOnly, User, Admin), and remediation.
  Relevance: Shows customer access is role-based (ReadOnly, User, Admin) for resource management — no evidence of direct customer access to security monitoring logs or immutable logs.

Selected answer: 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time Value 71 SEAL 2

Notes: Atlas has GDPR-aligned DPA with breach clauses, ISO 27001 processes, and proactive vuln disclosure via Defend Iceland. No evidence of real-time CSIRT data sharing or internal SLAs below regulatory max.

Evidence

• Data Processing Agreement - Atlas Cloud other 26. September 2026
  Atlas GDPR Art. 28 DPA defining processor duties incl. deletion of data and residual copies.
  Relevance: Demonstrates GDPR-aligned breach notification framework and contractual compliance obligations relevant to incident disclosure assessment.
• Report Security Incidents to CERT-IS | Ísland.is other 26. September 2026
  Official Icelandic government page for reporting security incidents to CERT-IS, Iceland's CSIRT, including procedures for critical infrastructure operators.
  Relevance: Confirms CSIRT cooperation is available in Iceland for Atlas Cloud but operates during daytime hours only — not real-time — supporting the moderate compliance rating.
• Two Security Reports and How We Responded other 26. September 2026
  Blog post detailing two access-control vulnerability reports via Defend Iceland, customer access roles (ReadOnly, User, Admin), and remediation.
  Relevance: Shows proactive vulnerability disclosure transparency and engagement with Iceland's security research community, supporting moderate compliance level.

Selected answer: 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching Value 71 SEAL 4

Notes: Atlas uses open-source tech with no vendor lock-in, can test/apply patches independently, but relies on upstream community schedules. Small team limits zero-day patch autonomy.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Shows Atlas uses open-source tech rather than proprietary non-EU vendor software, enabling independent patch testing/application but still dependent on upstream community release schedules.
• Atlas Trust Center other 26. September 2026
  Atlas Trust Center: ISO 27001:2022 certified, bug bounty, Tier 3 Borealis data centre in Iceland.
  Relevance: ISO 27001 certification and security controls demonstrate structured patch management processes, but managed service model means customers receive notice rather than deploying patches themselves.
• Two Security Reports and How We Responded – Atlas Blog other 27. September 2026
  Atlas Cloud blog post describing independent response to two valid security vulnerability reports, implementing fixes such as deny-by-default role enforcement and restricted bucket operations.
  Relevance: Demonstrates Atlas's ability to independently develop and apply security fixes, but also reveals reactive patching approach rather than systematic proactive patch development capability.

Selected answer: 4. High control by independent entities to request data from the vendor Value 107 SEAL 1

Notes: DPA grants GDPR Art 28 audit rights; ISO 27001 external audit done; Trust Center public; open-source stack. But no SOC 2 yet and audits are customer-scoped, not unrestricted.

Evidence

• Atlas Cloud — Certification Path other 26. September 2026
  Atlas's compliance roadmap showing ISO 27001:2022 certification (Aug 2026) with 93 Annex A controls, and future plans for ISO 27017/27018, EU CRA, and SOC 2.
  Relevance: Demonstrates external audit capability via ISO 27001 but shows SOC 2 attestation not yet available, limiting full independent audit access for EU entities.
• Atlas Trust Center other 26. September 2026
  Official Atlas (Iceland) security portal: ISO 27001:2022, bug bounty, Borealis Tier 3 datacenter, digital sovereignty claims.
  Relevance: Publicly accessible security controls and ISO 27001 certification enable EU entities to assess Atlas's auditability posture and request evidence from the vendor.
• Data Processing Agreement - Atlas Cloud other 26. September 2026
  Atlas GDPR Art. 28 DPA defining processor duties incl. deletion of data and residual copies.
  Relevance: DPA explicitly grants audit rights to controllers (EU entities) under GDPR Art 28(3)(h), enabling independent security and compliance audits by customers or their mandated auditors.

Selected answer: PUE < 1.3 Value 187 SEAL 4

Notes: Atlas Cloud runs on Borealis DC infrastructure with PUE ~1.03, well below 1.3, using 100% renewable energy. No EU-verified PUE found.

Evidence

• Borealis Data Center — Blönduós Campus other 27. September 2026
  Borealis's Blönduós campus page reports PUE as low as 1.03, 100% renewable energy from Blanda hydropower, ISO 27001 certified, 100+ MW capacity.
  Relevance: Directly demonstrates Atlas Cloud's infrastructure partner achieves PUE well below 1.3 with renewable energy and free-air cooling.
• Iceland Data Center Market Investment Analysis 2025–2030 (ResearchAndMarkets) other 27. September 2026
  Third-party market report confirms Icelandic DCs achieve sub-1.2 PUE ratios (vs. 1.57 global avg), naming Borealis as a key operator using direct-air cooling.
  Relevance: Independent market analysis corroborates that Borealis and other Icelandic DCs achieve PUE well below 1.3, supporting the assessment.
• Sustainable Data Centers | Borealis Data Center other 27. September 2026
  Borealis sustainability page highlights PUE 1.03, 100% renewable energy, EU Green Deal compliance, ISO 27001, waste heat recovery, and Festa membership.
  Relevance: Shows Borealis's energy efficiency metrics and sustainability roadmap including measurable initiatives like waste heat recovery.

Selected answer: No policy Value 0 SEAL 0

Notes: No documented hardware reuse, recycling, or circular economy program found for Atlas Cloud or its host Borealis DC. Sustainability focus is on renewable energy, not hardware lifecycle.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Confirms Atlas Cloud's sustainability claims are limited to renewable energy usage. No policy or program on hardware reuse, refurbishment, or end-of-life treatment is published.
• Borealis Data Center — Insights other 26. September 2026
  Borealis DC partnerships page: accredited Supermicro Service Partner, collaborations with IBM, Sardina Systems, Vespertec; OCP Ready certified.
  Relevance: Shows Borealis sustainability focus is energy and heat recovery, not hardware reuse/recycling or end-of-life treatment. No circular economy program for hardware documented.
• Climate Neutral Data Centre Pact other 27. September 2026
  EU-aligned initiative with 100+ signatories committing to server reuse/repair, circular economy targets by 2025, and climate neutrality by 2030.
  Relevance: Defines EU-aligned circular economy expectations for data centers (server reuse/repair). Borealis/Atlas not confirmed as signatory, indicating no such commitment.

Selected answer: No reporting Value 0 SEAL 1

Notes: Atlas Cloud makes general green claims but publishes no structured environmental impact reports, carbon emissions data, or sustainability KPIs. No ESG/annual report exists.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Shows Atlas makes qualitative green claims but lacks transparent measurement and disclosure of carbon emissions, water usage, or sustainability indicators required by the assessment question.
• Borealis Data Center – Official Website other 26. September 2026
  Borealis Data Center operates Icelandic data centers hosting Atlas Cloud. Partners with Supermicro, Dell, Nvidia — all non-EU hardware manufacturers.
  Relevance: Even Atlas's infrastructure partner lacks structured environmental impact reporting, confirming no transparent measurement or disclosure chain exists for Atlas's sustainability indicators.
• Climate Neutral Data Centre Pact other 27. September 2026
  EU-aligned self-regulatory pact where 100+ data centre operators commit to climate neutrality by 2030 with measurable energy efficiency, water conservation, and circular economy targets.
  Relevance: Atlas Cloud is not listed as a CNDCP member, indicating it does not participate in the EU's primary data centre environmental reporting and transparency framework.

Selected answer: Only green EU energy supplies Value 250 SEAL 4

Notes: Atlas Cloud runs on 100% renewable energy (hydro & geothermal) sourced entirely in Iceland (EEA), with no non-EU energy mix.

Evidence

• Atlas — Green Cloud Computing in Iceland other 24. September 2026
  Official site of Atlas Cloud ehf., Iceland's sovereign green cloud; ISO 27001, data stays in Iceland.
  Relevance: Directly confirms Atlas Cloud sources 100% renewable (green) energy for all infrastructure and operations from Iceland (EEA member).
• Borealis and Landsvirkjun Sign a 12 MW Power Purchasing Agreement other 27. September 2026
  Landsvirkjun (Iceland's national power company) signed a long-term PPA with Borealis for 12 MW of renewable hydropower at Blönduós campus.
  Relevance: Demonstrates formal renewable energy sourcing agreement between Borealis and Iceland's state-owned power company, confirming green EU/EEA energy supply.
• IBM and Borealis Data Center Unveil Their New Partnership other 27. September 2026
  Borealis Data Center confirms 100% renewable energy use (geothermal and hydropower) at its Icelandic facilities, operational since 2014.
  Relevance: Confirms Atlas Cloud's infrastructure host (Borealis) is powered exclusively by 100% renewable energy sourced in Iceland.