# What is Gaia-X, and does it matter when you choose a cloud?

Last updated: 2026-11-10

Gaia-X is a non-profit association under Belgian law that writes rules and runs a verification framework for cloud and data services. It isn't a cloud and doesn't host anything. For most teams picking where to deploy an app, a Gaia-X credential is a useful, machine-readable summary of what a provider declares or has certified, but it doesn't replace reading the contract, the subprocessor list and the certificates behind it. It matters most if you join a European data space or answer a tender that names Gaia-X labels.

## Gaia-X at a glance

| Question | Answer from Gaia-X's own pages |
|---|---|
| What is it? | The Gaia-X European Association for Data and Cloud AISBL, based in Brussels |
| Who founded it? | 11 French and 11 German organisations, in early 2021 |
| Is it a cloud provider? | No. Its FAQ says it provides no applications, infrastructure or storage |
| What does it produce? | Specifications, policy rules, a Trust Framework, labels and open-source compliance software |
| Who checks compliance? | Gaia-X Digital Clearing Houses, run by providers the association accredits |
| How is it funded? | Mainly by its members. One EU-funded project, the Data Spaces Support Centre, covers about 2% of its yearly budget |
| Can non-EU companies join? | Yes, as members. Only EU companies may sit on the Board of Directors, and only EEA companies may propose a director |

## Why it exists

The association describes its goal as a federated system that links many providers and users, so that data can be shared across companies and sectors under common rules. Its outcome, in its own words, "will not be a cloud". The practical work happens in two places: the rules in the Compliance Document, and the software that checks those rules and issues signed credentials.

Much of its activity targets **data spaces**, shared environments where companies in a sector such as mobility, health or agriculture exchange data. The Lighthouse projects and sector Ecosystems on its site are mostly of that kind. If you're simply hosting a web app, that part of Gaia-X won't touch you.

## The compliance levels

The Gaia-X Compliance Document, release 4.0.0, defines a baseline called **Standard Compliance** and three optional labels. The baseline is the minimum to take part in the Gaia-X ecosystem. The labels add criteria and stronger proof, from Label Level 1, the lowest, to Label Level 3, the highest.

| Level | How most criteria are proven | Where customer data must stay | European control rules |
|---|---|---|---|
| Standard Compliance | Declaration by the provider | No requirement, but transfers outside the EU/EEA must be described | None |
| Label Level 1 | Declaration | No requirement, but transfers outside the EU/EEA must be described | None |
| Label Level 2 | Certification for data protection and security criteria | The provider must offer an EU/EEA-only option | None |
| Label Level 3 | Certification | All customer data processed and stored in the EU/EEA | EU/EEA head office, no control by non-EU shareholders, safeguards against non-EU legal orders, operating autonomy |

Two details are worth knowing before you read any badge:

- **A declaration is a self-statement.** At Standard Compliance and Label Level 1, the provider describes its terms, its security measures and its transfers using the Gaia-X vocabulary. That's the provider's own word, not a certificate from an auditor.
- **Certification usually means an existing scheme.** For each criterion the document lists accepted standards, such as SecNumCloud, BSI C5, the CISPE code of conduct, the EU Cloud Code of Conduct and CSA CCM. A Label Level 2 or 3 provider is leaning on certificates you can ask for directly.

The labels also carry sustainability criteria, for example an annual Power Usage Effectiveness target of 1.3 in cool climates and 1.4 in warm ones, declared at Level 1 and certified at Levels 2 and 3.

## What to check before you count a Gaia-X claim

- **Which level, and for which service.** Labels attach to a service offering, not to a whole company. "Gaia-X member" says nothing about any service at all.
- **Member versus compliant.** Membership means the company joined the association and can help write the rules. Compliance means a clearing house issued a credential for a specific offering.
- **Declaration versus certificate.** Below Label Level 2, ask which statements are only declared, then ask for the audit report or certificate if they matter to you.
- **The certificates underneath.** A label that relies on SecNumCloud or BSI C5 is only as current as those certificates. Check their scope and expiry.
- **Your own requirement.** A data space or a tender may require a specific level. A GDPR question usually doesn't, and Gaia-X won't settle it for you.
- **The rest of your stack.** Your code host, email service, error tracking and payment provider each have their own jurisdiction, whatever badge the hosting layer carries.

## Does it matter for choosing a cloud?

For most small teams, Gaia-X works as a checklist more than a filter. The criteria in Label Level 3 are a precise statement of what "sovereign" can mean: data only in the EU/EEA, an EU head office, no non-EU control, and safeguards against foreign orders. You can ask any provider those questions whether or not it has a label, as the [data residency vs data sovereignty guide](/i/data-residency-vs-data-sovereignty) explains level by level.

It matters more in three situations:

1. **You're joining a data space** that asks its participants for Gaia-X credentials. Then your own company needs one too.
2. **A public or regulated buyer names a label** in a tender. Read the exact level required. Level 3 excludes providers controlled from outside the EU/EEA.
3. **You want to compare providers on the same criteria.** Machine-readable credentials make that easier, as long as you look at what was certified rather than declared.

It matters less when your question is the US CLOUD Act or Schrems II. There, the useful facts are who owns the provider and where each subprocessor sits, covered in [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act) and [Schrems II explained](/i/schrems-ii-explained).

## Where Eurobase stands

Eurobase hasn't published a Gaia-X credential for any of its services. The company is registered in Warsaw, Poland, and your projects are hosted on European infrastructure run by Scaleway, a French provider. Put the Label Level 3 questions to it and this is what you'll find:

| Label Level 3 topic | Eurobase |
|---|---|
| Data only in the EU/EEA | Apps, functions, containers, files and logs run on European infrastructure only |
| EU/EEA head office | Registered in Warsaw, Poland |
| Non-EU subprocessors | Connecting GitHub or GitLab adds a US company, GitHub, Inc. or GitLab Inc. Codeberg, a German association, is the European option. Stripe handles billing under its own transfer safeguards |
| Certification behind the claims | No certificate yet. Work toward ISO 27001 and SOC 2 has started |

You can check each answer yourself, but no third-party audit stands behind them, and Level 2 and 3 labels need one. If a tender demands a certified Gaia-X label, Eurobase doesn't meet it today. To see which part of a project runs where, read the [host in the EU guide](/docs/guides/host-in-the-eu); every supplier is named on the [subprocessor list](/legal/subprocessors).

## Frequently asked questions

### Is Gaia-X a European cloud like AWS?

No. Gaia-X's own FAQ says it's neither a cloud provider nor a cloud service provider. It writes rules and runs software that checks providers against them. You still rent servers or a platform from a company.

### Is Gaia-X mandatory for EU companies?

Not as a law. It's a voluntary framework from a private association. It becomes a requirement only when a data space, a buyer or a contract asks for it.

### Can AWS, Microsoft or Google be part of Gaia-X?

They can be members, and Gaia-X says it works with hyperscalers. Its statutes keep non-EU companies off the Board of Directors. Label Level 3 also requires an EU/EEA head office and no control by non-EU shareholders.

### What's the difference between Gaia-X and EUCS?

EUCS is a cloud certification scheme prepared by ENISA, the EU cybersecurity agency, and it would carry legal weight once adopted. Gaia-X is a private association's framework that reuses existing certifications as evidence. For its current status, see [data residency vs data sovereignty](/i/data-residency-vs-data-sovereignty).

### Is Gaia-X software open source?

Gaia-X says its software follows open-source principles, commonly under the Eclipse Public License 2.0. Its specifications are published free of charge under a Creative Commons licence.

## Sources

- [Gaia-X: About](https://gaia-x.eu/about/)
- [Gaia-X: FAQ](https://gaia-x.eu/faq/), for the founding, funding, governance, software and "not a cloud provider" answers
- [Gaia-X Compliance Document 4.0.0: Executive summary](https://docs.gaia-x.eu/policy-rules-committee/compliance-document/latest/Executive_Summary/)
- [Gaia-X Compliance Document 4.0.0: Compliance for cloud services](https://docs.gaia-x.eu/policy-rules-committee/compliance-document/latest/criteria_cloud_services/), for the criteria per level
- [Data residency vs data sovereignty](/i/data-residency-vs-data-sovereignty), [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act) and [Schrems II explained](/i/schrems-ii-explained)
- [Eurobase guide: host a web app in the EU](/docs/guides/host-in-the-eu)
- [Eurobase subprocessor list](/legal/subprocessors)