European Digital Sovereignty Index: collection method

What the study measures

Lindstead studies which providers appear in the public technical records of European organisations. The study covers public bodies and organisations listed in official registers, and reports results by country and sector.

It uses public registers, published procurement notices, public DNS records and one homepage request per measurement round. From that request it records response headers, certificate information and the hostnames referenced in the returned HTML.

What the study does not do

• It does not run page scripts or load third-party resources.
• It does not log in, create accounts, test for vulnerabilities or send mail to an organisation.
• It follows robots.txt and stated crawl delays, with at most one request per host every five seconds.
• DNS queries go through public resolvers with a shared rate limit and backoff. There are two DNS rounds, at least seven days apart.

The collector identifies itself as LindsteadResearch/2.0 (+https://lindstead.com/research/european-digital-sovereignty-index/method; contact@lindstead.com).

What a record shows

A public record shows a configuration or a statement. It does not prove service use, data volume, contracts, data location or the ability of a foreign government to obtain data. A domain-verification record shows a domain claim; the study does not conclude from it that an organisation uses an AI service.

Publication and storage

Lindstead names organisations only with verified public evidence. Security indicators and tenant information are published as totals only. The public download leaves out tenant identifiers, per-organisation security fields, personal contact details and raw verification tokens. Unknown ownership stays unknown.

For each record Lindstead stores the source, the collection time and a hash of the response. Homepage content is processed in memory and not kept. Cookies, authentication headers and personal contact details are discarded.

Exclusion or correction

An organisation can ask to be left out of future measurement, or report an error, at contact@lindstead.com. Include the organisation name, its domain and the request. Please do not send passwords, identity documents or internal records.

Lindstead replies within one working day. An exclusion request stops queued collection for that domain while it is checked. A confirmed error gets a dated correction in the data, the article and the charts, and an organisation can ask for its response to be added to the article.

Who runs the study

Lindstead is a trade name of Resolving Delta B.V. and works independently. Vendors do not pay for inclusion in this study or for its conclusions. The study follows the Lindstead research policy. Source licences stay attached to reused data; CC BY 4.0 applies only to material Lindstead can license on those terms.