Skip to main content
Bawin·Compliance
Sovereignty

Where your evidence sits, and who can reach it.

A supply chain you cannot see is a control you do not have. Every supplier that can reach customer evidence, or the platform that computes a reading, is named below with its role, its jurisdiction and the data it can reach. Nothing here is a certification. It is a statement of fact you can check and hold us to.

BWNv2.1UK/EU2026-07-28
MakerMethodologyResidencyEvidence

Ownership and jurisdiction

Registered entity
Bawin Limited167–169 Great Portland Street5th FloorLondonW1W 5PFUnited Kingdom
Control

Wholly owned by its founder. No external investor holds equity, board rights or veto over methodology. No vendor, certification body or assessment body holds any interest.

What sovereignty means here

  • One jurisdiction of incorporation

    Bawin Limited is incorporated in England and Wales and is not a subsidiary, affiliate or branch of a foreign parent. There is no overseas entity that can direct disclosure of your evidence.

  • No resale, no referral fees

    Bawin observes cloud and security platforms it does not resell, and takes no compensation from any vendor it reads. There is no commercial relationship that a reading could favour.

  • Evidence stays in region

    Evidence records are held in the EU and are not replicated outside the UK/EU for processing, analytics or support. Support access is from the UK.

  • Your evidence is yours

    We do not use customer evidence to train models, to build benchmarks that identify you, or to populate any product surface outside your own account.

The supply chain, named

Three suppliers. Each is listed with what it does, where it is established, where it processes, and what it can reach. We will publish a change to this table before it takes effect, not after.

SupplierRoleEstablishmentProcessing regionData reachedForeign-access exposure
Cloudflare, Inc.Edge delivery, TLS termination, DNS, DDoS protectionUnited StatesUK/EU edge locationsRequest metadata in transit. No evidence at rest.Yes — ultimate parent is subject to the US CLOUD Act and FISA 702.
Hetzner Online GmbHApplication and database hostingGermanyGermany (EU)Evidence records, control state and account records at rest.No — German parent, no extraterritorial disclosure regime.
Proton AGCorrespondence and transactional email, inbound and outboundSwitzerlandSwitzerland (UK and EU adequacy)Whatever a correspondent chooses to send us, and account correspondence.No — Swiss parent, no extraterritorial disclosure regime.

Cloudflare is established in the United States and terminates TLS at UK/EU edge locations; it sees request metadata in transit and holds no evidence at rest. That exposure is stated rather than hidden behind the word “UK-hosted”.

The foreign-access column states, per supplier, whether its ultimate parent is subject to an extraterritorial disclosure regime such as the US CLOUD Act. It is a column, not a footnote, because it is the question that decides whether a residency claim holds.

The model provider

No third-party model provider is in use. No customer evidence, and no derived control state, is sent to an external model. Clause mapping and challenge generation run on rules and crosswalks held in this platform, in the EU, and a reading is computed by arithmetic that is published in full on the method page. If that changes, the provider will be named in the table above with the same five columns as every other supplier, and the change will be published before it takes effect.

The exit position

A sovereignty claim that does not survive the vendor’s own failure is not a sovereignty claim. These are the terms on which you leave.

Evidence export

Every evidence record, with its source, timestamp and hash, as newline-delimited JSON plus the original artefacts. Self-service at any time; retrievable for 90 days after termination, then destroyed.

Crosswalk export

The control spine and every framework crosswalk in force against your account, as OSCAL and CSV, under a perpetual, irrevocable licence to use them for your own compliance purposes after you leave.

Reading history

Every reading ever issued to you, with the method edition in force at the time and the inputs that produced it, exported alongside the evidence so any historic figure can be recomputed without us.

Notice before withdrawal

Ninety days' written notice before any service withdrawal or material change to the export formats above, and the export surface stays available for the whole of that period.

What this page is not

This page is maintained by Bawin Limited and is editorial content it controls. It is not an independent verification, an audit outcome, a certification, or a warranty. It states the arrangements in force on the date shown. Where you need contractual commitments — a data processing agreement, a subprocessor change-notice period, or a defined support-access boundary — write to contact@bawin.co and we will put them in writing.

Trust centre → Method →