Object Storage Service – Gaia-X compliant? Yes!

In this article, you will read

• how Gaia-X assesses cloud services for sovereignty,
• about the role of the Open Telekom Cloud’s Object Storage Service,
• and how the service passed the compliance check.

What exactly does Gaia-X do? The European initiative for the sovereign use of IT resources and data exchange made waves when it was launched in 2019. Now, five years later, Gaia-X continues to shape Europe’s digital future. In November 2024, the latest update on its progress was shared at the Gaia-X Summit in Helsinki, where German Economics Minister Robert Habeck participated digitally. He once again underscored the importance of a sovereign digital infrastructure for Europe.

T-Systems, a founding member of Gaia-X, plays a key role in pioneering projects like Catena-X and Structura-X. The company also operates a Gaia-X Clearing House. To test the compliance process in a real-world scenario, the Clearing House team sought a “test subject.” They turned to the Open Telekom Cloud’s Object Storage Service (OBS),  which is already successfully used in various data ecosystems, such as the Copernicus Data Space Ecosystem, where it handles and processes large volumes of satellite data.

An S3-compatible object storage service, already in use for European projects and coming from a European cloud provider? Intuition suggests: “Gaia-X compliant.” However, to be certain, the Clearing House went through the official compliance process with the Object Storage Service.

The “Gaia-X Policy Rules and Labeling Criteria for Cloud Services” define over 50 criteria to assess compliance with Gaia-X standards. These criteria are based on established certification systems such as SecNumCloud, BSI C5 Type 2, ISO/IEC 27001, CISPE, the EU Cloud Code of Conduct (GDPR, XAAS), TISAX, and others. However, none of these existing systems guarantee full compliance with all of Gaia-X’s labeling criteria.

To assess  the Gaia-X compliance of the Open Telekom Cloud’s Object Storage Service, the team first compiled around 30 pieces of legal, technical, and organizational information. This information was organized into verifiable credentials – machine-readable statements enhanced with a digital signature. These credentials were then bundled together into a single “envelope,” known as a “verifiable presentation” in the world of sovereign digital identities. With this, the compliance check could begin.

The verifiable presentation was submitted online to the Loire compliance service, which operates on an official Gaia-X Digital Clearing House node. “T-Systems fulfills this criterion, but trust in a federated environment only comes from mutual recognition. That’s why we used one of Gaia-X's digital Clearing House nodes, not ours,” explains Kelečević. This automated process allowed the service to achieve Compliance Level 1 . In just about ten seconds, the Gaia-X Clearing House validated 40 criteria, some of which involved thousands of individual comparisons and checks. In October 2024, the Object Storage Service was awarded the Gaia-X Compliance Label Level 1.

In addition to basic compliance and Level 1 certification, the Gaia-X compliance framework also includes Levels 2 and 3. These higher levels require a more thorough evaluation of Gaia-X’s standards and criteria. For example, Level 2 necessitates additional verification by an independent auditor or chartered accountant.

“The Gaia-X compliance proves our assumption that the Open Telekom Cloud is the right choice for European companies. It allows sovereign use of cloud resources and sovereing data processing,” says Ryan Skipp from the Open Telekom Cloud team. “The successful run for the Object Storage Service is an incentive to achieve the official compliance level 1 for other services in 2025.”