Where UK government cloud data is declared to go
Every one of the 14,468 cloud services UK public bodies can buy off the shelf on G-Cloud 15's hosting, infrastructure-software and software lots, counted by what its supplier declared about where the data goes and who it is bought from. Declarations, not locations.
Updated 20 September 2026 · every figure counted from all 14,468 G-Cloud 15 service listings in the three in-scope lots, 20 September 2026 · method and dataset below
Declarations, not locations
A count of what a supplier ticked on a procurement form. Nothing in this study is evidence of where any data physically sits, and no service was inspected, tested or measured. Government’s own guidance makes the same point from the other side: Multi-region cloud and software-as-a-service (Government Digital Service, 5 February 2025) notes that “while the vendor may offer a technical deployment in a region of your choice, there are often components of the service which are not in the same geography”.
Scroll the chart sideways to see all of it →
The form asks “Where is data stored and processed? (checkboxes: United Kingdom | European Economic Area (EEA) | Other locations)”. Those three are the whole taxonomy, so this study names no place the form does not offer as an option, and never reads “Other locations” as any particular country or jurisdiction: the data do not support it. “Other locations” is the only option beyond the UK and the EEA, and it names nowhere. An option in an older framework that named a specific transfer arrangement has been removed and is not in G-Cloud 15, and “Rest of world” has never been one.
Scroll the chart sideways to see all of it →
Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) (1,788); Infrastructure Software as a Service (iSaaS) (2,778); Software as a Service (SaaS) (9,902). Lot 3 Cloud support services is never asked these questions and is excluded; the whole publicly listed catalogue is 39,730 services. Lot 1b, IaaS and PaaS above OFFICIAL, is asked them but is withheld from the public catalogue as classified information under Framework Schedule 1, available to customers with a legitimate right to use it — so the lot handling data above OFFICIAL cannot be counted from public sources.
Scroll the chart sideways to see all of it →
Digital Marketplace, 20 September 2026. n = 14,468 services (a population, not a sample). Every listed service in scope was fetched and parsed, and the counts this study uses that the catalogue can also filter match its own facets exactly: six facet counts across two fields — two of the three location options, and all four supplier-type options — plus the population count, difference zero on each. That is the whole of the external cross-check. The third location option, “Other locations”, has no search filter, and neither the user-control question nor the knowledge question can be filtered at all, so those rest on the detail-page parse alone. The catalogue filters on other fields too — certifications, clearances, pricing, support — and none of those was measured or reconciled here.
Whether the buyer gets a say
On the supplier's own declaration, 27.6% (3,996 of 14,468) of in-scope G-Cloud 15 services do not let a buyer specify where its data is stored and processed. Measured only against the services that were asked the question, it is 27.7% (3,996 of 14,428).
The single headline conceals a wide spread. Software is where the choice is least likely to be offered: 34.0% (3,370 of 9,902) of Lot 2b SaaS services say the buyer cannot specify where data is stored and processed, against 16.0% (286 of 1,788) of Lot 1a IaaS and PaaS and 12.2% (340 of 2,778) of Lot 2a infrastructure software. The infrastructure lots are where region pickers are most normal. The difference is one of degree rather than of kind: even in SaaS a clear majority, 65.7% (6,501 of 9,902), say the buyer can specify.
Scroll the chart sideways to see all of it →
Source: Digital Marketplace service detail pages, question “Can users specify where data is stored and processed? (Yes / No)”, crawled 20 September 2026. Each bar is measured against its own lot’s service count, printed beside the label. Self-declared by the supplier.
| Answer | Services | Share of all 14,468 | Share of the 14,428 asked |
|---|---|---|---|
| Buyer can specify the location | 10,432 | 72.1% | 72.3% |
| Buyer cannot specify the location | 3,996 | 27.6% | 27.7% |
| Not asked (supplier says it does not know the locations) | 40 | 0.3% | — |
Scroll the table sideways to see every column →
Two denominators are printed because the question branches: 40 services answer “No” to whether the supplier knows where data is stored and processed, which suppresses this question and the location question. Those services are recorded as not asked, never as blank or zero. A wider reading that treats “we do not know” as no say either gives 27.9% (4,036 of 14,468).
Read this finding with
- A single headline conceals a wide spread between lots; the per-lot figures are given above and each carries its own denominator.
- Three definitions of 'no say' are given and they differ: the answer 'No' to the user-control question, the same measured only against the services asked it, and the widest reading that also counts the services whose supplier says it does not know the locations.
Where these services say the data can go
61.4% (8,882 of 14,468) can store or process data outside the United Kingdom on their own declaration, and 38.0% (5,502 of 14,468) beyond the United Kingdom and the EEA. 38.3% (5,546 of 14,468) are declared United Kingdom only.
Scroll the chart sideways to see all of it →
Source: detail pages, question “Where is data stored and processed? (checkboxes: United Kingdom | European Economic Area (EEA) | Other locations)”, crawled 20 September 2026. Ticks are not exclusive, so these do not sum to 100%. The United Kingdom and EEA figures match the catalogue’s own search facets exactly (13,427 and 8,604); “Other locations” has no search filter, so it rests on the detail-page parse alone.
Read as a partition rather than as ticks, every in-scope service falls in exactly one of three bands: 38.3% (5,546 of 14,468) are declared United Kingdom only, 61.4% (8,882 of 14,468) can go beyond it, and the remaining 0.3% (40 of 14,468) were not asked the question at all. The 38.0% (5,502 of 14,468)that tick “Other locations” are not a fourth band: they are a subset of the services that can go beyond the United Kingdom, counted again inside that 61.4%. Every percentage here is measured against all 14,468 in-scope services, not against each other. The lots differ sharply: 10.5% of Lot 1a IaaS and PaaS services are UK-only, against 47.6% of Lot 2b SaaS.
Scroll the chart sideways to see all of it →
Each bar sums to that lot's own total: every service falls in exactly one band. Bands are cumulative in reach, not in ticks — a service ticking “Other locations” is counted there whatever else it ticks, and the two non-UK bands do not imply that the United Kingdom is also ticked. The exact combinations, including the services that tick the EEA or “Other locations” with no United Kingdom tick, are in the table below.
| Combination ticked | Services | Share of 14,468 |
|---|---|---|
| United Kingdom | 5,546 | 38.3% |
| United Kingdom + European Economic Area (EEA) + Other locations | 4,906 | 33.9% |
| United Kingdom + European Economic Area (EEA) | 2,902 | 20.1% |
| European Economic Area (EEA) | 478 | 3.3% |
| European Economic Area (EEA) + Other locations | 318 | 2.2% |
| Other locations | 205 | 1.4% |
| United Kingdom + Other locations | 73 | 0.5% |
| Not asked (supplier does not know) | 40 | 0.3% |
Scroll the table sideways to see every column →
Every combination that occurs, in full. The three options in the form are United Kingdom, European Economic Area (EEA) and Other locations; nothing finer is asked and nothing finer is reported here. A “United Kingdom” tick is a declaration about the service as the supplier describes it, not a statement that every component sits in the United Kingdom.
Read this finding with
- The three options are the whole schema. Beyond those three the question names no place, and neither does this study: 'Other locations' is never read here as any particular country or jurisdiction.
- The ticks are not exclusive: a service may tick all three. Percentages therefore do not sum to 100 and are each stated against the same population.
- The policy position, in government's own words: 'There is no government policy which directly prevents departments or services from storing or processing cloud-based data in any specific country, however you need to consider the implications of where you host your data' (Cloud guide for the public sector). What the framework requires is a declaration, not a location.
How much of the in-scope catalogue is resold, and from whom
49.2% (7,114 of 14,468) of in-scope services are declared as reselling another organisation's services. Among those, the most frequently named organisation is Microsoft, on between 22.1% and 32.8% (1,570 to 2,332 of 7,114) of resold services and between 10.8% and 16.1% of the in-scope catalogue, depending on which of the four published counting rules is used.
Reselling is the majority position in the infrastructure lots and the minority position in software: 76.6% (2,129 of 2,778) of Lot 2a infrastructure software and 71.5% (1,279 of 1,788) of Lot 1a IaaS and PaaS are resold, against 37.4% (3,706 of 9,902) of Lot 2b SaaS.
| Supplier type, as the form asks it | Services | Share of 14,468 |
|---|---|---|
| Not a reseller | 7,354 | 50.8% |
| Reseller providing extra features and support | 2,820 | 19.5% |
| Reseller providing extra support | 3,032 | 21.0% |
| Reseller (no extras) | 1,262 | 8.7% |
Scroll the table sideways to see every column →
These four counts sum to the population exactly and match the catalogue’s own supplier-type filters exactly, which is the strongest cross-check available for any measure in this study.
Whose services are being resold
The organisation is a free-text box, so concentration is a range, not a number. There are 1,043 distinct answers as typed. The table below is a ranking inside a published list: 26 organisations were chosen before the answers were counted, each with its own published patterns, and an answer naming anything else falls into other (not a tracked organisation) however often it is typed. That is why the largest single group is other (not a tracked organisation) at 29.0% (2,063 of 7,114)of resold services — a residual of the rules, not a long tail of small organisations. The largest answers it swallows are printed beneath the table, so the residual can be read rather than assumed. Read all of it as a range across counting rules.
| Organisation named (the ten most often named of the 26 tracked) | Resold services | Share of 7,114 resold | Share of 14,468 in scope |
|---|---|---|---|
| Microsoft | 1,938 | 27.2% | 13.4% |
| Amazon Web Services | 481 | 6.8% | 3.3% |
| Salesforce | 478 | 6.7% | 3.3% |
| SAP | 286 | 4.0% | 2.0% |
| Oracle | 167 | 2.4% | 1.1% |
| ServiceNow | 152 | 2.1% | 1.1% |
| 124 | 1.7% | 0.9% | |
| Palo Alto Networks | 103 | 1.4% | 0.7% |
| Proofpoint | 98 | 1.4% | 0.7% |
| 8x8 | 85 | 1.2% | 0.6% |
Scroll the table sideways to see every column →
This table is the ten most often named of the 26 organisations on the published pattern list; the remaining tracked organisations, including those whose percentage is withheld because fewer than ten services name them, are in the dataset. Only those 26 organisations could appear here at all. It is not a ranking of every organisation suppliers named. Sole-organisation counting: an answer naming more than one tracked organisation is grouped separately and counted under each one it mentions only in the wider “any mention” rule. The normalisation is mechanical, published in full in the dataset and can be rerun or disputed. The field cannot tell a reseller of a provider’s own platform from a reseller of third-party software that merely runs on it; both are counted the same way, because the question does not distinguish them.
What the tracked list leaves out
The residual holds 771 distinct answers. The largest of them, “ICS.AI”, is given by 146 services — more than 20 of the 26 tracked organisations, and enough to place it seventh in the table above had it been on the list. Nothing was done about that after the fact: the list was fixed before counting and is published as it stood.
| Answer, as typed (not on the tracked list) | Resold services | Share of 7,114 resold | Share of 14,468 in scope |
|---|---|---|---|
| ICS.AI | 146 | 2.0% | 1.0% |
| Arctic Wolf | 33 | 0.5% | 0.2% |
| ITouchVision Ltd | 30 | 0.4% | 0.2% |
| Nutanix | 28 | 0.4% | 0.2% |
| Check Point Software Technologies | 27 | 0.4% | 0.2% |
| Workday | 27 | 0.4% | 0.2% |
| Rapid7 | 25 | 0.3% | 0.2% |
| Appian | 23 | 0.3% | 0.2% |
| Barracuda Networks | 23 | 0.3% | 0.2% |
| NetApp | 22 | 0.3% | 0.1% |
Scroll the table sideways to see every column →
The named-organisation table ranks only the 26 organisations in the published pattern list. Any other organisation, however often it is named, falls into 'Other (not a tracked organisation)'. These are the largest such answers, as typed, so that the residual can be read rather than assumed. They are counted by exact answer after case and punctuation folding, not by pattern, so variant spellings of the same organisation are not combined. These are counts of an answer, not of an organisation: an organisation that suppliers spell several ways is split across several rows here, which is precisely what the pattern list exists to prevent for the organisations on it.
One organisation, four countings
Microsoft is the most frequently named organisation on every rule we tried, and which rule you pick moves the answer by 5.3 points of the in-scope catalogue and 10.7 points of resold services. The field is free text, so the Microsoft share depends entirely on how the strings are counted. All four countings are given. Against the whole in-scope catalogue they run from 10.8% to 16.1% of 14,468 services; against resold services alone, from 22.1% to 32.8% of 7,114. No rule reaches one service in five of the whole in-scope catalogue; every one of them exceeds one in five of resold services. All four are in the table below, so a reader can choose rather than be given one number.
| Counting rule | Services | Share of 7,114 resold | Share of 14,468 in scope |
|---|---|---|---|
| the answer names Microsoft, by organisation name or product brand, alone or alongside others; the widest defensible reading | 2,332 | 32.8% | 16.1% |
| the answer contains 'Microsoft' or 'MSFT' anywhere | 1,950 | 27.4% | 13.5% |
| Microsoft is the only tracked organisation the answer names, by organisation name or by a Microsoft product brand | 1,938 | 27.2% | 13.4% |
| the answer is exactly the word 'Microsoft' | 1,570 | 22.1% | 10.8% |
Scroll the table sideways to see every column →
Sources: detail pages, free-text question “Which organisation's services do you resell? (free text)”. Named organisations appear here only because suppliers typed those names into a public procurement form; nothing here is a statement about any organisation’s conduct.
Read this finding with
- The brief for this study pre-registered a resold share of 62.3%. The census does not support it and neither does the catalogue's own supplier-type filter. The disagreement is reported in full below rather than resolved by preference.
- The brief also drafted 'Microsoft behind roughly one service in five'. No counting rule over the free-text field reaches that. The claim is dropped and the four countings are published instead.
- A reseller declaration says who the supplier buys from. It says nothing about where that organisation puts the data.
- The named-organisation table is a ranking inside a published list of 26 organisations, fixed before counting. Anything else typed into the box falls into 'Other (not a tracked organisation)', so that group is a residual of the rules, not a long tail of small organisations. The largest untracked answers are printed beside the table.
Resold services and data location together
Resold services are more likely to be declared as capable of holding data outside the United Kingdom: 78.7% (5,595 of 7,114) of resold services, against 44.7% (3,287 of 7,354) of services that are not resold.
Part of that gap is which lot a service sits in rather than anything about reselling. Reselling is much commoner in the infrastructure lots (71.5% of Lot 1a and 76.6% of Lot 2a are resold, against 37.4% of Lot 2b SaaS), and those are also the lots with the highest non-UK rates (89.5% and 76.4% of services can go beyond the United Kingdom, against 52.1% in SaaS). This study does not publish a within-lot cross-tabulation of location against supplier type, so how much of the gap survives lot composition cannot be read off this page.
The user-control field runs the other way. Resold services are more likely to let the buyer pick a location (16.8% (1,192 of 7,114) say the buyer cannot, against 38.1% (2,804 of 7,354)of services that are not resold) — consistent with resold capacity being the kind of platform that has region pickers in the first place, though the data cannot test that.
Scroll the chart sideways to see all of it →
Each bar sums to that supplier type's own total. The two non-UK bands do not imply that the United Kingdom is also ticked. Source: detail pages, 20 September 2026, cross-tabbing two self-declared fields.
| Supplier type | Services | Can go outside the UK | Beyond the UK and EEA | UK only | No buyer say over location |
|---|---|---|---|---|---|
| Not a reseller | 7,354 | 44.7% | 20.1% | 55.2% | 38.1% |
| Reseller providing extra features and support | 2,820 | 65.7% | 33.9% | 33.3% | 20.9% |
| Reseller providing extra support | 3,032 | 85.3% | 73.3% | 14.6% | 15.6% |
| Reseller (no extras) | 1,262 | 91.7% | 67.0% | 8.2% | 10.2% |
Scroll the table sideways to see every column →
Each percentage is measured against that supplier type’s own service count, not against the population. Self-declared on both axes.
Read this finding with
- This is an association between two self-declared fields on the same form. It is not evidence of cause, and it is not evidence of where anything is.
- Part of this gap is lot composition rather than reselling. Reselling is much commoner in the infrastructure lots, which also have the highest non-UK rates, so the two fields move together by lot. This study does not publish a within-lot cross-tabulation of location against supplier type, which is what would be needed to separate them.
Context: a concentration rule that does not apply here
In July 2026 HM Treasury designated four technology providers as Critical Third Parties: Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL and Oracle Corporation UK Limited. That is a financial-services regime and it places no duty on a public body buying from G-Cloud.
The designated entities, effective 13 July 2026, are Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, Oracle Corporation UK Limited. The Bank of England says oversight “is limited to the resilience of the services they provide to UK financial firms” and that designation “is not the same as authorisation by the regulators”. It is included here only to show that UK authorities have already treated concentration in a handful of cloud providers as systemic in one sector— financial services, not public procurement.
These are legal entity names. None of them is the trading name a G-Cloud reseller types into the free-text reselling field, so they cannot be matched to the catalogue and no attempt was made to. Sources: HM Treasury and the Bank of England, 10 July 2026.
Read this finding with
- Labelled as financial services every time it appears. It is not a public sector rule and must not be read as one.
- The designated entities are legal entity names. None of them is the trading name a G-Cloud reseller types into the free-text reselling field, so they cannot be matched to the catalogue.
Footnote: suppliers who say they do not know
40 services (0.3% of 14,468) answer 'No' to 'Do you know where your data is stored and processed?'. Those services are then asked neither the location question nor the user-control question.
It is a fraction of one per cent of the in-scope catalogue and is reported here only because the branching it triggers changes the denominators above. By lot: Lot 1a IaaS and PaaS 0, Lot 2a Infrastructure software 9, Lot 2b SaaS 31. No percentage is given where the count is below ten.
Read this finding with
- This is a footnote, not a finding. It is a fraction of one per cent of the in-scope catalogue and is reported here only because the branching it triggers changes the denominators above.
What was cross-checked, and what could not be
| Measure | Detail-page census | Catalogue’s own facet | Difference |
|---|---|---|---|
| population | 14,468 | 14,468 | 0 |
| ticks united kingdom | 13,427 | 13,427 | 0 |
| ticks eea | 8,604 | 8,604 | 0 |
| supplier type not a reseller | 7,354 | 7,354 | 0 |
| supplier type reseller extra features and support | 2,820 | 2,820 | 0 |
| supplier type reseller extra support | 3,032 | 3,032 | 0 |
| supplier type reseller no extras | 1,262 | 1,262 | 0 |
Scroll the table sideways to see every column →
These are the only measures with a whole-population cross-check outside the detail pages. The user-control question, the knowledge question and the 'Other locations' tick are not search-filterable and rest entirely on the parse, which is why the second parser exists.The user-control question, the knowledge question and “Other locations” cannot be filtered in the search, so among this study’s headline measures only the resold share has a whole-population cross-check outside the detail pages. That is why a second parser, written from the raw HTML by a structurally different method, re-parsed a seeded random sample of 600 services field by field: 4,800 field comparisons, 0 disagreements (100% agreement on the sample). The two parsers share no field-level expression and no section logic, but they do share two module-level helpers — the tag-stripping regular expression and the personal-data scrub — both of which run before any field is identified, so the check is independent at field level and not below it. A sample of this size with no disagreements does not establish that the full 14,468-page parse is error-free. Parse integrity: 14,468 services parsed, 0 identifier mismatches, 0 pages not on G-Cloud 15, 0 unexpected location values, 0 personal-data hits.
Where the sources disagree
- What share of the in-scope catalogue is resold? This study's brief, pre-registered before the crawl: 62.3% · Detail-page census (this study): 49.2% (7,114 of 14,468) · Digital Marketplace search facets, same day: 7,114 of 14,468. The two independent measurements of the live catalogue agree with each other and disagree with the pre-registered figure by about thirteen points. The census figure is published, the pre-registered figure is reported here, and the reseller-concentration section of the page is written from the census.
- What are the three lots in the population called? This study's brief: 'cloud hosting' 1,788; 'cloud software' 9,902; and, wrongly, 'cloud support' 2,778 · RM1557.15 question export and the live catalogue: Lot 1a IaaS and PaaS 1,788; Lot 2b SaaS 9,902; Lot 2a Infrastructure Software (iSaaS) 2,778. The counts are identical; the third label in the brief is wrong. Cloud support is Lot 3, has 25,262 services, is never asked the data-location questions and is excluded from the census. The correct lot names are used throughout and the exclusion is stated.
- How many providers has HM Treasury designated as Critical Third Parties? This study's brief: three (AWS EMEA, Google Cloud EMEA, Microsoft) · HM Treasury and Bank of England, 10 July 2026: four: Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, Oracle Corporation UK Limited. The published figure of four is used, with the legal entity names as designated.
- When did G-Cloud 15 start? RM1557.15 agreement page (primary): 6 August 2026 · Pre-award commentary found in web search: 17 September 2026. The agreement page is the primary source and is used; the disagreement is recorded here rather than resolved silently.
- Do the search index facets and the detail pages agree? Search index facets, 20 September 2026: all seven measures, as listed in the table above · Detail-page census, 20 September 2026: the same seven figures, identical on each. Both are printed measure by measure in the verification block. They agree exactly on every measure that the search can answer.
What the brief expected, and what the census found
| Pre-registered measure | Brief, before the crawl | Census | Verdict |
|---|---|---|---|
| user control = Yes | 69.4% | 72.1% (10,432 of 14,468) | close, census higher |
| any non-UK location | 59.2% | 61.4% (8,882 of 14,468) | close, census higher |
| resold | 62.3% | 49.2% (7,114 of 14,468) | REJECTED: about thirteen points apart, and the catalogue's own facets agree with the census, not the brief |
| supplier does not know | 0.3% | 0.3% (40 of 14,468) | agrees |
| Microsoft share of the in-scope catalogue | roughly one service in five (about 20%) | 16.1% (2,332 of 14,468) | REJECTED: no counting rule over the free-text field reaches one in five |
Scroll the table sideways to see every column →
Figures written into the study brief before the crawl, set against the census. Reported so that a checker can see what moved. These are expectations, not sources. Any pre-registered headline that does not reproduce within its stated tolerance is cut, not caveated. Two of the fivefigures written into this study’s own brief before the crawl did not survive it and were cut rather than caveated: the resold share, and the drafted line that Microsoft was behind roughly one service in five. Both are in the table above with the census figure that replaced them, and the resold disagreement is set out in full in the list above that.
What was measured, when, and how
How these figures were produced
- The self-declared data-location and reselling fields of every service published on the G-Cloud 15 framework in the three lots that are asked those questions and appear in the public catalogue. Every service listed on the Digital Marketplace under G-Cloud 15 in lots 1a, 2a and 2b on the snapshot date. A population, not a sample.
- Snapshot taken 2026-09-20. Search index walked 2026-09-20T04:21:32Z to 2026-09-20T04:26:13Z; detail pages fetched 2026-09-20T04:33:39Z to 2026-09-20T05:57:46Z.
- The search index was walked lot by lot, 30 results a page, 484 pages, collecting 14,468 service identifiers. Per-lot counts were asserted against the catalogue's own facets before anything else ran.
- Every one of the 14,468 service detail pages was fetched once and stored gzipped in a dated snapshot directory, so nothing is fetched twice and the parse can be rerun offline.
- Only the main content region of each page was kept. Supplier contact panels were removed before anything was written to disk.
- Each page was parsed by locating the 'Asset protection' and 'Resellers' sections and reading their summary-list rows, so a label appearing elsewhere on the page cannot be mistaken for a field.
- Branching was handled explicitly: where the supplier answers 'No' to knowing the locations, the location and user-control questions are absent and are recorded as not asked, never as blank or zero.
- A second parser, written from the raw HTML and using a different method, re-parsed a seeded random subset field by field as an independent check.
- Whole-population counts for the fields the search can filter were reconciled against the catalogue's own facets, measure by measure.
- Branching: 'Do you know where your data is stored and processed?' gates two follow-ups: the location checkboxes and the user-control question. Answering 'No' suppresses both. 'Organisation whose services are being resold' appears only when the supplier type is one of the three reseller answers.
- Crawl policy: about 3 requests a second, at most 2 in flight; user agent ServnetResearchBot/1.0 (+https://www.servnetuk.com/research); back off on 429 or any 5xx; stop entirely if the site signals it does not want the traffic. The host serves no robots.txt (HTTP 404), so no crawl directives are published. The politeness limits were self-imposed, not permitted by a robots file. The Digital Marketplace terms and conditions were read in full: they contain no anti-automation, anti-crawling or reuse clause, and no occurrence of crawl, scrape, robot, spider, automated, harvest, bulk or rate limit. They open: 'The Civil Service website is maintained for your personal use and viewing. Access and use by you of this site constitutes your acceptance of these terms and conditions.' That is a statement about who the site is maintained for, not a restriction on reuse: the same page carries the Open Government Licence v3.0 in its footer, which expressly permits copying, publishing, adapting and commercially exploiting the information. Outcome: 14,468 pages, 14,468 HTTP 200, no 429 responses, no refusals.
- Personal data: The supplier contact panel on each page - contact name, telephone number and email address - was removed before anything was written to disk, and a second scrub for email addresses, telephone numbers and mailto links was applied to every free-text field kept for the published dataset. The stored snapshot is the page with its contact panel removed, not a page with every number in it removed: a supplier that types a corporate switchboard number into a free-text answer leaves it in the snapshot, and the scrub is what keeps it out of the published files. The published CSV contains no email address, no telephone number and no contact field. The Open Government Licence does not cover personal data.
- Excluded from the published dataset: Datacentre security standards; Penetration testing frequency and approach; Protecting data at rest; Data sanitisation process and type; Equipment disposal approach; Staff security clearance and government security clearance; Supplier contact details of any kind.
- This analysis makes no network request. Rerunning scripts/research/g-cloud-15-data-location-census-2026/analyse.py against the stored snapshot must reproduce the CSV and the README byte for byte, and this JSON byte for byte apart from its 'built' timestamp, which records when the file was last generated. The CSV and README checksums are printed in the dataset block for exactly that check.
The questions, exactly as suppliers are asked them
| Field | Question and options, as published in the framework question export |
|---|---|
| knowledge | Do you know where your data is stored and processed? (Yes / No) |
| locations | Where is data stored and processed? (checkboxes: United Kingdom | European Economic Area (EEA) | Other locations) |
| user control | Can users specify where data is stored and processed? (Yes / No) |
| supplier type | Are you reselling another organisation's services? (I'm not a reseller | I'm a reseller providing extra features and support not available from the original supplier | I'm a reseller providing extra support | I'm a reseller not providing extra features or support) |
| resold organisation | Which organisation's services do you resell? (free text) |
Scroll the table sideways to see every column →
Limits
- Every figure in this study is a count of what a supplier ticked on a form. Nothing here is evidence of where any data physically sits, and no part of this study inspected, tested or measured any service.
- Government's own guidance makes the same point from the other direction: 'while the vendor may offer a technical deployment in a region of your choice, there are often components of the service which are not in the same geography' (Multi-region cloud and software-as-a-service, Government Digital Service, 5 February 2025). A 'United Kingdom' tick does not mean the whole service is in the United Kingdom.
- The census is a dated snapshot. The search index was walked between 2026-09-20T04:21:32Z and 2026-09-20T04:26:13Z and the 14,468 detail pages were fetched between 2026-09-20T04:33:39Z and 2026-09-20T05:57:46Z. G-Cloud 15 is an open framework under the Procurement Act 2023 that reopens for new suppliers, so the catalogue will grow and these counts will move.
- The population is three of the four publicly listed lots: Lot 1a IaaS and PaaS (1,788), Lot 2a Infrastructure Software iSaaS (2,778) and Lot 2b SaaS (9,902). The whole publicly listed catalogue is 39,730 services. Lot 3 Cloud support services (25,262) is excluded because it is never asked the data-location questions: this is documented in Framework Schedule 1, in the RM1557.15 question export, and in the live search facets, which leave Lot 3 untouched when a location filter is applied.
- Lot 1b (IaaS and PaaS above OFFICIAL) is asked the same location questions but is not published in the public catalogue. Framework Schedule 1 requires its service information to be treated as classified information, available to customers with a legitimate right to use it. The census therefore covers the publicly listed catalogue, not the whole framework: the lot that handles data above OFFICIAL cannot be counted from public sources, though a customer with a legitimate right to the information can see it.
- The location question offers exactly three options: United Kingdom, European Economic Area (EEA) and Other locations. It names no place beyond those three, and neither does this study. 'Other locations' is the only option beyond the UK and the EEA, and nothing in the data supports reading it as any particular country or jurisdiction. An option in G-Cloud 13 that named a specific transfer arrangement is not one in G-Cloud 15; 'Rest of world' has never been one.
- The questions branch. Answering 'No' to 'Do you know where your data is stored and processed?' suppresses both the location checkboxes and the user-control question, so those services are recorded as not asked, never as blank or zero. Both denominators are printed for every affected figure: all services, and only those asked.
- 'Organisation whose services are being resold' is free text. Answers vary in case, punctuation, legal suffix and scope, some name a product rather than an organisation, and some name several. The normalisation is mechanical, published in full and can be rerun or disputed; the concentration figures should be read as a range across counting rules, not as one number.
- The table of named organisations ranks only the 26 organisations on the published pattern list, which was fixed before the answers were counted. An organisation not on that list falls into 'Other (not a tracked organisation)' however many services name it: the largest untracked answer, 'ICS.AI', is given by 146 services, more than 20 of the 26 tracked organisations. The largest untracked answers are published beside the table for exactly that reason.
- The field cannot tell a reseller of a hyperscaler's own platform from a reseller of third-party software that merely runs on it. Both are counted the same way, because the question does not distinguish them.
- No comparison with G-Cloud 14 is possible from this source. The search index's frameworks parameter is silently ignored: filtering to G-Cloud 14 or G-Cloud 12 returns the identical 39,730 results with identical facets. Framework membership was instead confirmed per service from the listing tag on every record.
- Only two of the three location options can be filtered in the search, and the user-control and knowledge questions cannot be filtered at all. Among this study's headline measures, therefore, only the resold share has a whole-population cross-check outside the detail pages, which is why a second, independently written parser re-checked a random subset field by field.
- Security-posture fields on the same pages (datacentre security standards, penetration testing frequency and approach, protecting data at rest, data sanitisation, staff and government security clearance) were read past and are deliberately excluded from the published dataset. Nothing in this study identifies a named organisation as insecure.
- The supplier contact panel - contact name, telephone number and email address - was removed from every page before anything was written to disk, and a second scrub was run over every free-text field kept for the dataset. Numbers a supplier typed into a free-text answer of its own are not contact fields and were not removed from the snapshot; the scrub is what keeps them out of the published files, which contain no email address and no telephone number. The Open Government Licence does not cover personal data.
- Counts of listings are not counts of money, customers or usage. A service with no buyers counts the same as one used across government.
- Suppliers answer these questions themselves and are not audited on them by this study. Some answers are plainly approximate: an answer that names several organisations, or a product line rather than an organisation, is still recorded exactly as given.
- No third party was contacted for this study. Everything here comes from already-published pages and documents.
Prior work
We found no prior published count of the G-Cloud data-location declarations. Searches for prior counts of the G-Cloud data-location fields, for supplier concentration measured by listing, or for reseller share of the in-scope catalogue returned commentary and spend analysis only. No prior work counting these fields was found. The catalogue publishes no bulk export of these fields: they exist only on the individual service pages, which is why this was done by reading all 14,468 of them. Three plausible machine-readable paths on the catalogue host were probed on 2026-09-20 and all three returned HTTP 404 (https://www.applytosupply.digitalmarketplace.service.gov.uk/api/g-cloud/services, https://www.applytosupply.digitalmarketplace.service.gov.uk/api/services and https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/search.json); the historic api.digitalmarketplace.service.gov.uk host did not respond at all. Those probes are recorded, with their statuses, in data/research/g-cloud-15-data-location-census-2026/framework_and_policy_context.json. Not described as a first. The absence of prior work is a negative search result, not proof that none exists.
- Cloud services market investigation (Competition and Markets Authority, opened 2023-10-05, final decision 2025-07-31): Competition in UK public cloud infrastructure services, including market structure and concentration measured by UK share of supply by revenue (Appendix D). Found an adverse effect on competition and recommended prioritising strategic market status investigations into Microsoft and Amazon Web Services. How ours differs: The CMA measured revenue shares across the whole UK cloud infrastructure market. We count catalogue entries on one public procurement framework and their self-declared data-location and reseller fields. Different unit (a listed service, not a pound of revenue) and different population (services a public body can buy off the shelf).
- From 14 to 15: The G-Cloud Supplier playbook (Stotles, 2025-11-04): G-Cloud spend and supplier-share analysis for suppliers bidding into G-Cloud 15, drawing on award and spend data. Gated report. How ours differs: Stotles analyses money awarded through the framework. We analyse the catalogue itself - what is listed and what suppliers declared about it - which is a different question and available before any spend occurs.
- G-Cloud framework supplier and spend datasets (Tussell, ongoing): Commercial procurement-intelligence platform consolidating UK public sector spend, contract and framework data, including per-framework supplier listings. How ours differs: Tussell tracks suppliers and spend. No published Tussell output counts the data-location declarations on service listings.
- DSIT issues guidance to support public sector hosting of cloud workloads in overseas datacentres; and UK government under fire over public sector guidance on using overseas clouds (Computer Weekly, February 2025): Reporting and reaction to the February 2025 multi-region guidance. Qualitative; no counts of services or of data-location declarations. How ours differs: We put a number on the catalogue that the policy debate has so far argued about without one.
- Digital Marketplace frameworks (YAML question definitions), frameworks up to G-Cloud 13 (Crown Commercial Service / Government Digital Service (GitHub: Crown-Commercial-Service/digitalmarketplace-frameworks, formerly alphagov), last framework definition committed January 2023): Open-source definitions of the service questions, including dataStorageAndProcessing, dataStorageAndProcessingLocations, dataStorageAndProcessingUserControl, resellingType and resellingOrganisations, with their lot dependencies and follow-up logic. How ours differs: This is the schema, not a count. It stops at G-Cloud 13; the G-Cloud 13 option list still included an option naming a specific transfer arrangement, which G-Cloud 15 no longer offers. For G-Cloud 15 we used the published RM1557.15 question export instead.
Sources
- Digital Marketplace, G-Cloud 15 search index (Government Commercial Agency (formerly Crown Commercial Service); platform built by the Government Digital Service) — Service identifiers, names, supplier names and lot for all 14,468 in-scope services, plus the whole-population facet counts used as verification anchors. Licence: Open Government Licence v3.0. Footer of every search and service page: 'All content is available under the Open Government Licence v3.0, except where otherwise stated', with Crown copyright.
- Digital Marketplace, G-Cloud 15 service detail pages (Government Commercial Agency; platform built by the Government Digital Service) — Knowledge of data storage and processing locations; data storage and processing locations; user control over those locations; supplier type; organisation whose services are being resold; service categories. Licence: Open Government Licence v3.0.
- RM1557.15 G-Cloud question export (Government Commercial Agency) — The exact supplier-facing wording, option lists and branching rules for the five questions used here, across all five lots. Licence: Open Government Licence v3.0. The RM1557.15 pages themselves carry '© Crown copyright' with no licence notice. The licence statement covering them is on the agency's terms page (https://www.gca.gov.uk/terms-and-conditions, retrieved 2026-09-20): 'Most content on our website is subject to Crown copyright protection and is published under the Open Government Licence (OGL). Some content is exempt from the OGL - check the list of exemptions.'
- RM1557.15 Framework Schedule 1 (Specification) v2.1 and the RM1557.15 agreement page (Government Commercial Agency) — Lot structure, framework start date of 6 August 2026, which lots are asked the data-location questions, and the requirement that Lot 1b service information be treated as classified. Licence: Open Government Licence v3.0. The RM1557.15 pages themselves carry '© Crown copyright' with no licence notice. The licence statement covering them is on the agency's terms page (https://www.gca.gov.uk/terms-and-conditions, retrieved 2026-09-20): 'Most content on our website is subject to Crown copyright protection and is published under the Open Government Licence (OGL). Some content is exempt from the OGL - check the list of exemptions.'
- Government Commercial Agency terms and conditions (Government Commercial Agency) — The licence statement that covers the two RM1557.15 sources above, which do not carry a licence notice on their own pages. Licence: Open Government Licence v3.0. The RM1557.15 pages themselves carry '© Crown copyright' with no licence notice. The licence statement covering them is on the agency's terms page (https://www.gca.gov.uk/terms-and-conditions, retrieved 2026-09-20): 'Most content on our website is subject to Crown copyright protection and is published under the Open Government Licence (OGL). Some content is exempt from the OGL - check the list of exemptions.'
- Digital Marketplace terms and conditions (Government Digital Service) — Checked in full for any anti-automation, crawling or reuse clause. There is none. Licence: Open Government Licence v3.0.
- Open Government Licence v3.0 (The National Archives) — The licence terms under which this dataset is derived and republished. The licence covers copyright and database right and excludes personal data. Licence: Open Government Licence v3.0.
- Multi-region cloud and software-as-a-service (Government Digital Service) — The policy position that there is no universal requirement for OFFICIAL data to be physically located in the UK, and the caveat that parts of a service may sit outside the chosen region. Licence: Open Government Licence v3.0.
- Cloud guide for the public sector (Central Digital and Data Office / Government Digital Service) — The statement that no government policy directly prevents storing or processing cloud data in any specific country. Licence: Open Government Licence v3.0.
- UK financial system strengthened with new safeguards for major technology providers (HM Treasury) — The four Critical Third Parties designated, effective 13 July 2026. Licence: Open Government Licence v3.0. A financial-services regime. It places no duty on a public body buying from G-Cloud and is used here as labelled context only.
- UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury (Bank of England) — Three short quotations bounding the scope of the regime. Licence: Bank of England website terms; quoted as fair reporting of a public announcement, not reused as data. Financial services only.
Downloads: CSV, 14,468 rows (one row per listed service) · README · JSON. SHA-256 of the CSV: 2ae5de922e10ed02997a3ecfd035221c97d5f16bc1f3f845c8fef71b9cc41755. Contains public sector information licensed under the Open Government Licence v3.0. The licence does not cover personal data; the supplier contact panel was removed before storage and no contact field, email address or telephone number appears in any output.
Questions
How many G-Cloud services let the buyer choose where its data is stored?
On the suppliers' own declarations, 72.1% (10,432 of 14,468) of the 14,468 in-scope G-Cloud 15 services say a buyer can specify where data is stored and processed, and 27.6% (3,996 of 14,468) say it cannot. Measured only against the 14,428 services actually asked the question, the "no" figure is 27.7%. The spread between lots is wide: Lot 1a IaaS and PaaS 16.0%, Lot 2a Infrastructure software 12.2%, Lot 2b SaaS 34.0%.
Can data on G-Cloud services be stored outside the UK?
61.4% (8,882 of 14,468) of in-scope services tick the European Economic Area, "Other locations", or both, so on their own declaration the data can be stored or processed outside the United Kingdom. 38.0% (5,502 of 14,468) tick "Other locations", the only option in the form beyond the UK and the EEA; it names no country. 38.3% (5,546 of 14,468) tick the United Kingdom and nothing else. These are supplier declarations on a procurement form, not observations of where data physically sits.
Does UK government policy require public sector data to stay in the UK?
No, but the permission is conditional. The Government Digital Service publication Multi-region cloud and software-as-a-service (5 February 2025) says in one sentence: “Government data at OFFICIAL (including the SENSITIVE marking) can be stored and processed in data centres or Cloud regions overseas when satisfactory legal, data protection and security practices are in place; there is no universal requirement for government data classified as OFFICIAL to be physically located in the UK.” The Cloud guide for the public sector adds that no government policy directly prevents storing or processing cloud data in any specific country, while noting that you need to consider the implications of where you host your data. The same GDS guidance warns that where a vendor offers a deployment in a region of your choice, there are often components of the service which are not in the same geography. This study counts declarations against that policy backdrop; it does not assess whether any individual choice is lawful or appropriate, which depends on the data and the buyer’s own assessment.
How much of G-Cloud 15's three in-scope lots is resold?
49.2% (7,114 of 14,468) of the in-scope services are declared as reselling another organisation's services, across three reseller answers: reseller providing extra features and support 2,820, reseller providing extra support 3,032, reseller (no extras) 1,262. The catalogue's own supplier-type filters give the identical counts. Reselling is far more common in the infrastructure lots (71.5% of Lot 1a, 76.6% of Lot 2a) than in software (37.4% of Lot 2b).
Which organisation is resold most often on G-Cloud 15?
Microsoft, on every counting rule we tried, but the share depends on the rule because the field is free text. Counting any answer that names Microsoft by organisation name or product brand — the widest defensible reading — gives 32.8% (2,332 of 7,114) of resold services and 16.1% (2,332 of 14,468) of the whole in-scope catalogue. The narrowest, where the answer is exactly the word "Microsoft", gives 10.8% (1,570 of 14,468). All four countings are published. The field also cannot tell a reseller of a provider's own platform from a reseller of third-party software that merely runs on it.
Does this study show where UK government data actually is?
No, and it does not try to. Every figure is a count of what a supplier ticked on a procurement form. No service was inspected, tested or measured, and the location analysis names no place the form does not itself offer as an option: the form offers exactly three — United Kingdom, European Economic Area (EEA) and Other locations — and "Other locations" is never read here as any particular country or jurisdiction. A "United Kingdom" tick does not mean the whole service is in the United Kingdom.
Which parts of G-Cloud 15 are not in this census?
The census covers three of the four publicly listed lots: Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) (1,788), Infrastructure Software as a Service (iSaaS) (2,778), Software as a Service (SaaS) (9,902). Lot 3 Cloud support services is excluded because it is never asked the data-location questions. Lot 1b, IaaS and PaaS above OFFICIAL, is asked the same questions but is not published in the public catalogue: Framework Schedule 1 requires its service information to be treated as classified information, available to customers with a legitimate right to use it. The whole publicly listed catalogue is 39,730 services, so this is a census of the part of the framework where the questions are both asked and published, and the lot handling data above OFFICIAL cannot be counted from public sources.
Can I reuse this data?
Yes, under two licences, and a reuser should carry both. The source data are Crown copyright reused under the Open Government Licence v3.0, whose condition is the attribution "Contains public sector information licensed under the Open Government Licence v3.0.". Servnet's own analysis and derived tables are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0), whose condition is credit to "Servnet G-Cloud 15 Data Location Census 2026, https://www.servnetuk.com/research/g-cloud-15-data-location-census-2026". The same two statements appear in the README that ships with the CSV and in the Dataset schema on this page. The Open Government Licence also excludes third party rights the information provider is not authorised to license. It covers the Crown-published catalogue. Short supplier-authored strings - a service name, its categories and the free-text answer naming the organisation resold - are reproduced as factual identifiers of listed services; the long supplier-authored service descriptions on the same pages were deliberately not republished. The CSV (14,468 rows, one per listed service) and the JSON are linked in the method section. Security-posture fields and all supplier contact details are excluded from the published dataset.
Where this leads
Servnet Research publishes dated observations from public sources for information only. It is not legal, security, financial or investment advice, and data are provided without warranty. Spotted an error, or want something re-measured or reviewed? See our corrections and takedown policy.
Related Servnet research: UK public sector and VMware after Broadcom · UK public sector email security census 2026 · What public bodies’ own FOI answers say about Windows Server 2016 · More Servnet research
About this study
- What it is: a census of the self-declared data-location and reselling fields of all 14,468 services listed on the G-Cloud 15 framework in lots 1a, 2a and 2b, read from the Digital Marketplace on 20 September 2026. Every figure is a count of what a supplier ticked on a procurement form; nothing here is evidence of where any data physically sits, and no service was inspected, tested or measured. G-Cloud 15 is an open framework, so the catalogue will grow and these counts will move.
- Licence and attribution: Two licences apply and a reuser should carry both. Source data are Crown copyright, reused under the Open Government Licence v3.0, whose condition is the statement “Contains public sector information licensed under the Open Government Licence v3.0.” Servnet’s analysis and derived tables are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0), whose condition is credit to “Servnet G-Cloud 15 Data Location Census 2026, https://www.servnetuk.com/research/g-cloud-15-data-location-census-2026”. The same two statements appear in the README that ships with the CSV and in this page’s Dataset schema. The licence does not cover personal data; the supplier contact panel was removed before storage and no contact field, email address or telephone number appears in any output. The Open Government Licence also excludes third party rights the information provider is not authorised to license. It covers the Crown-published catalogue. Short supplier-authored strings - a service name, its categories and the free-text answer naming the organisation resold - are reproduced as factual identifiers of listed services; the long supplier-authored service descriptions on the same pages were deliberately not republished. Corrections and takedown: https://www.servnetuk.com/research/corrections or webmaster@servnetuk.com.
- Third-party names: Microsoft, Amazon Web Services, Salesforce, SAP, Oracle, ServiceNow, Google, Palo Alto Networks, Proofpoint, 8x8, ICS.AI, Arctic Wolf, ITouchVision Ltd, Nutanix, Check Point Software Technologies, Workday, Rapid7, Appian, Barracuda Networks, NetApp and the other organisation and product names appearing in the reselling tables and in the published normalisation patterns are trade marks of their respective owners, used only to identify products and organisations. Servnet is not affiliated with, endorsed by or acting for them.
- Our interest: Servnet sells and maintains IT hardware and services, including some of the products and platforms this study measures. The study reports what the sources show; it is not a recommendation to buy anything, and no organisation paid for, sponsored or approved it.
- Errors and takedown: tell us at webmaster@servnetuk.com and we will check it; see the corrections and takedown policy.
Talk to a UK specialist
Get expert advice or a no-obligation quote — servers, storage, networking, maintenance, finance and cloud. We reply the same working day.