Where UK government cloud data is declared to go: a census of G-Cloud 15 Aggregate data: g-cloud-15-data-location-census-2026.csv WHAT THIS IS A census of the self-declared data-location and reselling fields of every cloud service UK public bodies can buy off the shelf on the G-Cloud 15 framework in the three lots that are asked those questions and appear in the public catalogue: Lot 1a Infrastructure as a Service and Platform as a Service (1,788), Lot 2a Infrastructure Software as a Service (2,778) and Lot 2b Software as a Service (9,902). n = 14,468 services. This is a population, not a sample. One row per service. Every figure is a count of what a supplier ticked on a form. Nothing in this dataset is evidence of where any data physically sits. No service was inspected, tested or measured. SNAPSHOT DATE: 2026-09-20 Search index walked 2026-09-20T04:21:32Z to 2026-09-20T04:26:13Z. Detail pages fetched 2026-09-20T04:33:39Z to 2026-09-20T05:57:46Z. COLUMNS service_id: Digital Marketplace service identifier. framework: Always 'G-Cloud 15'; checked on every page, not assumed. lot_code: 1a, 2a or 2b. lot_slug: Lot slug as used by the Digital Marketplace search. lot_name: Full lot name. service_name: Service name as listed. supplier_name: Supplier organisation name as listed. An organisation, never a person. service_categories: Service categories as listed, pipe-separated. knows_data_locations: Supplier's answer to 'Do you know where your data is stored and processed?': Yes or No. location_question_asked: yes or no. 'no' means the supplier answered No above, which suppresses the location and user-control questions. location_uk: 1 if 'United Kingdom' is ticked, 0 if the question was asked and it is not, empty if the question was not asked. location_eea: 1 / 0 / empty, as above, for 'European Economic Area (EEA)'. location_other: 1 / 0 / empty, as above, for 'Other locations'. This is the only option beyond the UK and the EEA and it names no country. location_combination: The ticked options joined, or 'Not asked (supplier does not know)'. any_non_uk_location: 1 if EEA or Other locations is ticked; empty if not asked. beyond_uk_and_eea: 1 if 'Other locations' is ticked; empty if not asked. uk_only: 1 if United Kingdom is ticked and neither other option is; empty if not asked. user_control_over_location: Supplier's answer to 'Can users specify where data is stored and processed?': Yes, No, or empty if not asked. user_control_asked: yes or no. supplier_type: One of: Not a reseller; Reseller providing extra features and support; Reseller providing extra support; Reseller (no extras). is_reseller: 1 for any of the three reseller answers, else 0. resold_organisation_raw: Free-text answer to 'Which organisation's services do you resell?', exactly as given, scrubbed of anything resembling contact data. Empty when not a reseller. resold_organisation_group: The normalised group, by the published rules. Either one tracked organisation, 'Multiple organisations named', 'Other (not a tracked organisation)' or 'Blank or unusable answer'. An answer that is empty, or is exactly one of the null placeholders 'n/a', 'na', 'none', 'not applicable', '-' or 'not a reseller' after case-folding, is grouped as 'Blank or unusable answer' and is tested against no pattern. resold_organisation_mentions: Every tracked organisation the answer names, pipe-separated. An answer naming several appears under each. snapshot_date: The date the census was taken. service_url: The public service page the row was read from. METHOD The search index was walked lot by lot, 30 results a page, 484 pages, collecting 14,468 service identifiers. Per-lot counts were asserted against the catalogue's own facets before anything else ran. Every one of the 14,468 service detail pages was fetched once and stored gzipped in a dated snapshot directory, so nothing is fetched twice and the parse can be rerun offline. Only the main content region of each page was kept. Supplier contact panels were removed before anything was written to disk. Each page was parsed by locating the 'Asset protection' and 'Resellers' sections and reading their summary-list rows, so a label appearing elsewhere on the page cannot be mistaken for a field. Branching was handled explicitly: where the supplier answers 'No' to knowing the locations, the location and user-control questions are absent and are recorded as not asked, never as blank or zero. A second parser, written from the raw HTML and using a different method, re-parsed a seeded random subset field by field as an independent check. Whole-population counts for the fields the search can filter were reconciled against the catalogue's own facets, measure by measure. EXACT QUESTION WORDING (RM1557.15 G-Cloud question export; identical in lots 1a, 1b, 2a and 2b) knowledge: Do you know where your data is stored and processed? (Yes / No) locations: Where is data stored and processed? (checkboxes: United Kingdom | European Economic Area (EEA) | Other locations) user_control: Can users specify where data is stored and processed? (Yes / No) supplier_type: Are you reselling another organisation's services? (I'm not a reseller | I'm a reseller providing extra features and support not available from the original supplier | I'm a reseller providing extra support | I'm a reseller not providing extra features or support) resold_organisation: Which organisation's services do you resell? (free text) BRANCHING 'Do you know where your data is stored and processed?' gates two follow-ups: the location checkboxes and the user-control question. Answering 'No' suppresses both. 'Organisation whose services are being resold' appears only when the supplier type is one of the three reseller answers. 40 services answer 'No' to the knowledge question and are therefore asked neither the location question nor the user-control question. They are recorded as not asked, never as blank or zero. Percentages in the study that are affected by this are given against both denominators: all 14,468 services, and the 14,428 services actually asked. WHAT IS EXCLUDED, AND WHY Lot 3 Cloud support services (25,262 services on the snapshot date) is excluded because it is never asked the data-location questions. Lot 1b (IaaS and PaaS above OFFICIAL) is asked them but is not published in the public catalogue: Framework Schedule 1 requires its service information to be treated as classified information. The whole publicly listed catalogue is 39,730 services, so this dataset covers three of the four published lots and should never be described as the whole catalogue. Security-posture fields on the same pages (datacentre security standards, penetration testing frequency and approach, protecting data at rest, data sanitisation, equipment disposal, staff and government security clearance) are deliberately excluded. Nothing here identifies any organisation as insecure. Supplier contact names, telephone numbers and email addresses were removed at fetch time, before anything was stored, and a second scrub was applied to every free-text field kept here. The Open Government Licence does not cover personal data. HOW THE CRAWL WAS RUN Rate: about 3 requests a second, at most 2 in flight. User-Agent: ServnetResearchBot/1.0 (+https://www.servnetuk.com/research). Backoff: back off on 429 or any 5xx; stop entirely if the site signals it does not want the traffic. The host serves no robots.txt (HTTP 404), so no crawl directives are published. The politeness limits were self-imposed, not permitted by a robots file. The Digital Marketplace terms and conditions were read in full: they contain no anti-automation, anti-crawling or reuse clause, and no occurrence of crawl, scrape, robot, spider, automated, harvest, bulk or rate limit. They open: 'The Civil Service website is maintained for your personal use and viewing. Access and use by you of this site constitutes your acceptance of these terms and conditions.' That is a statement about who the site is maintained for, not a restriction on reuse: the same page carries the Open Government Licence v3.0 in its footer, which expressly permits copying, publishing, adapting and commercially exploiting the information. Outcome: 14,468 pages, 14,468 HTTP 200, no 429 responses, no refusals. LIMITS - Every figure in this study is a count of what a supplier ticked on a form. Nothing here is evidence of where any data physically sits, and no part of this study inspected, tested or measured any service. - Government's own guidance makes the same point from the other direction: 'while the vendor may offer a technical deployment in a region of your choice, there are often components of the service which are not in the same geography' (Multi-region cloud and software-as-a-service, Government Digital Service, 5 February 2025). A 'United Kingdom' tick does not mean the whole service is in the United Kingdom. - The census is a dated snapshot. The search index was walked between 2026-09-20T04:21:32Z and 2026-09-20T04:26:13Z and the 14,468 detail pages were fetched between 2026-09-20T04:33:39Z and 2026-09-20T05:57:46Z. G-Cloud 15 is an open framework under the Procurement Act 2023 that reopens for new suppliers, so the catalogue will grow and these counts will move. - The population is three of the four publicly listed lots: Lot 1a IaaS and PaaS (1,788), Lot 2a Infrastructure Software iSaaS (2,778) and Lot 2b SaaS (9,902). The whole publicly listed catalogue is 39,730 services. Lot 3 Cloud support services (25,262) is excluded because it is never asked the data-location questions: this is documented in Framework Schedule 1, in the RM1557.15 question export, and in the live search facets, which leave Lot 3 untouched when a location filter is applied. - Lot 1b (IaaS and PaaS above OFFICIAL) is asked the same location questions but is not published in the public catalogue. Framework Schedule 1 requires its service information to be treated as classified information, available to customers with a legitimate right to use it. The census therefore covers the publicly listed catalogue, not the whole framework: the lot that handles data above OFFICIAL cannot be counted from public sources, though a customer with a legitimate right to the information can see it. - The location question offers exactly three options: United Kingdom, European Economic Area (EEA) and Other locations. It names no place beyond those three, and neither does this study. 'Other locations' is the only option beyond the UK and the EEA, and nothing in the data supports reading it as any particular country or jurisdiction. An option in G-Cloud 13 that named a specific transfer arrangement is not one in G-Cloud 15; 'Rest of world' has never been one. - The questions branch. Answering 'No' to 'Do you know where your data is stored and processed?' suppresses both the location checkboxes and the user-control question, so those services are recorded as not asked, never as blank or zero. Both denominators are printed for every affected figure: all services, and only those asked. - 'Organisation whose services are being resold' is free text. Answers vary in case, punctuation, legal suffix and scope, some name a product rather than an organisation, and some name several. The normalisation is mechanical, published in full and can be rerun or disputed; the concentration figures should be read as a range across counting rules, not as one number. - The table of named organisations ranks only the 26 organisations on the published pattern list, which was fixed before the answers were counted. An organisation not on that list falls into 'Other (not a tracked organisation)' however many services name it: the largest untracked answer, 'ICS.AI', is given by 146 services, more than 20 of the 26 tracked organisations that do have a group. The largest untracked answers are published beside the table for exactly that reason. - The field cannot tell a reseller of a hyperscaler's own platform from a reseller of third-party software that merely runs on it. Both are counted the same way, because the question does not distinguish them. - No comparison with G-Cloud 14 is possible from this source. The search index's frameworks parameter is silently ignored: filtering to G-Cloud 14 or G-Cloud 12 returns the identical 39,730 results with identical facets. Framework membership was instead confirmed per service from the listing tag on every record. - Only two of the three location options can be filtered in the search, and the user-control and knowledge questions cannot be filtered at all. Among this study's headline measures, therefore, only the resold share has a whole-population cross-check outside the detail pages, which is why a second, independently written parser re-checked a random subset field by field. - Security-posture fields on the same pages (datacentre security standards, penetration testing frequency and approach, protecting data at rest, data sanitisation, staff and government security clearance) were read past and are deliberately excluded from the published dataset. Nothing in this study identifies a named organisation as insecure. - The supplier contact panel - contact name, telephone number and email address - was removed from every page before anything was written to disk, and a second scrub was run over every free-text field kept for the dataset. Numbers a supplier typed into a free-text answer of its own are not contact fields and were not removed from the snapshot; the scrub is what keeps them out of the published files, which contain no email address and no telephone number. The Open Government Licence does not cover personal data. - Counts of listings are not counts of money, customers or usage. A service with no buyers counts the same as one used across government. - Suppliers answer these questions themselves and are not audited on them by this study. Some answers are plainly approximate: an answer that names several organisations, or a product line rather than an organisation, is still recorded exactly as given. - No third party was contacted for this study. Everything here comes from already-published pages and documents. WHERE SOURCES DISAGREE - What share of the in-scope catalogue is resold? This study's brief, pre-registered before the crawl: 62.3% Detail-page census (this study): 49.2% (7,114 of 14,468) Digital Marketplace search facets, same day: 7,114 of 14,468 Reported as: The two independent measurements of the live catalogue agree with each other and disagree with the pre-registered figure by about thirteen points. The census figure is published, the pre-registered figure is reported here, and the reseller-concentration section of the page is written from the census. - What are the three lots in the population called? This study's brief: 'cloud hosting' 1,788; 'cloud software' 9,902; and, wrongly, 'cloud support' 2,778 RM1557.15 question export and the live catalogue: Lot 1a IaaS and PaaS 1,788; Lot 2b SaaS 9,902; Lot 2a Infrastructure Software (iSaaS) 2,778 Reported as: The counts are identical; the third label in the brief is wrong. Cloud support is Lot 3, has 25,262 services, is never asked the data-location questions and is excluded from the census. The correct lot names are used throughout and the exclusion is stated. - How many providers has HM Treasury designated as Critical Third Parties? This study's brief: three (AWS EMEA, Google Cloud EMEA, Microsoft) HM Treasury and Bank of England, 10 July 2026: four: Microsoft Ireland Operations Limited, Google Cloud EMEA Limited, Amazon Web Services EMEA SARL, Oracle Corporation UK Limited Reported as: The published figure of four is used, with the legal entity names as designated. - When did G-Cloud 15 start? RM1557.15 agreement page (primary): 6 August 2026 Pre-award commentary found in web search: 17 September 2026 Reported as: The agreement page is the primary source and is used; the disagreement is recorded here rather than resolved silently. - Do the search index facets and the detail pages agree? The search index facets and the detail-page census, both 20 September 2026, return the same figure on every measure the search can answer: population 14,468; ticks united kingdom 13,427; ticks eea 8,604; supplier type not a reseller 7,354; supplier type reseller extra features and support 2,820; supplier type reseller extra support 3,032; supplier type reseller no extras 1,262. Reported as: Both are printed measure by measure in the verification block. They agree exactly on every measure that the search can answer. SERIES AND REVISIONS One dated census of a live catalogue. There is no earlier run of this measurement to compare against. None. This is the first publication of this dataset. Any later revision will be recorded here with its date and what changed. - G-Cloud 14 to G-Cloud 15 is a framework break. The search index's frameworks parameter is silently ignored, so the previous framework's catalogue cannot be retrieved from this source and no comparison is offered. - An option under G-Cloud 13 naming a specific transfer arrangement has been removed. Any comparison of location ticks across frameworks would be comparing different option lists. - G-Cloud 15 is an open framework that reopens for new suppliers after 18 and 36 months, so the catalogue grows between snapshots. A future census will not be comparing a fixed set of services. - The search index can lag the detail pages by a short interval. Where the two disagree, both are printed in the verification block. REPRODUCING THIS FILE This analysis makes no network request. Rerunning scripts/research/g-cloud-15-data-location- census-2026/analyse.py against the stored snapshot must reproduce the CSV and the README byte for byte, and this JSON byte for byte apart from its 'built' timestamp, which records when the file was last generated. The CSV and README checksums are printed in the dataset block for exactly that check. The full raw-string to normalised-group mapping for the reselling field is published at data/research/g-cloud-15-data-location-census-2026/resold-organisation-normalisation.csv so the normalisation can be checked or redone. HOW THE RESELLING FIELD IS NORMALISED Trim and collapse whitespace, strip surrounding punctuation and quotes, lower-case for matching only. An answer that is empty after that, or that is one of the null placeholders 'n/a', 'na', 'none', 'not applicable', '-' or 'not a reseller' (case-folded, exact match), is grouped as 'Blank or unusable answer' and is tested against no pattern. Every other string is tested against a published list of word-boundary patterns for each tracked organisation, in two tiers: patterns that name the organisation itself, and patterns that name one of its product or platform brands. A string matching exactly one tracked organisation is grouped under it; a string matching more than one is grouped as 'Multiple organisations named' and counted under each organisation it mentions in the 'any mention' counts; a string matching none is grouped as 'Other (not a tracked organisation)'. Nothing is inferred beyond these patterns. Only the 26 organisations listed in 'patterns' can appear as a named group or in the 'any mention' counts. The list was fixed before the answers were counted and is published in full. An organisation that is not on it falls into 'Other (not a tracked organisation)' however many services name it, so that residual is not a long tail by definition: the largest untracked answers are published in 'largest_untracked_answers' and the whole mapping is in the normalisation CSV. The table of named organisations is therefore a ranking within a published list, not a ranking of everything suppliers typed. Normalisation cannot tell a reseller of a hyperscaler's own platform from a reseller of third- party software that merely runs on it. Both are counted the same way, because the field does not distinguish them. SOURCES AND LICENCE - Digital Marketplace, G-Cloud 15 search index (Government Commercial Agency (formerly Crown Commercial Service); platform built by the Government Digital Service). https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/search Taken: Service identifiers, names, supplier names and lot for all 14,468 in-scope services, plus the whole-population facet counts used as verification anchors. Licence: Open Government Licence v3.0 - Digital Marketplace, G-Cloud 15 service detail pages (Government Commercial Agency; platform built by the Government Digital Service). https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/ Taken: Knowledge of data storage and processing locations; data storage and processing locations; user control over those locations; supplier type; organisation whose services are being resold; service categories. Licence: Open Government Licence v3.0 - RM1557.15 G-Cloud question export (Government Commercial Agency). https://assets.crowncommercial.gov.uk/wp-content/uploads/RM1557.15-G-Cloud-question-export.xlsx Taken: The exact supplier-facing wording, option lists and branching rules for the five questions used here, across all five lots. Licence: Open Government Licence v3.0 - RM1557.15 Framework Schedule 1 (Specification) v2.1 and the RM1557.15 agreement page (Government Commercial Agency). https://www.gca.gov.uk/rm1557-15-g-cloud-15-tender-documents Taken: Lot structure, framework start date of 6 August 2026, which lots are asked the data- location questions, and the requirement that Lot 1b service information be treated as classified. Licence: Open Government Licence v3.0 - Government Commercial Agency terms and conditions (Government Commercial Agency). https://www.gca.gov.uk/terms-and-conditions Taken: The licence statement that covers the two RM1557.15 sources above, which do not carry a licence notice on their own pages. Licence: Open Government Licence v3.0 - Digital Marketplace terms and conditions (Government Digital Service). https://www.applytosupply.digitalmarketplace.service.gov.uk/terms-and-conditions Taken: Checked in full for any anti-automation, crawling or reuse clause. There is none. Licence: Open Government Licence v3.0 - Open Government Licence v3.0 (The National Archives). https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ Taken: The licence terms under which this dataset is derived and republished. The licence covers copyright and database right and excludes personal data. Licence: Open Government Licence v3.0 - Multi-region cloud and software-as-a-service (Government Digital Service). https://www.gov.uk/government/publications/multi-region-cloud-and-software-as-a-service/multi- region-cloud-and-software-as-a-service-html Taken: The policy position that there is no universal requirement for OFFICIAL data to be physically located in the UK, and the caveat that parts of a service may sit outside the chosen region. Licence: Open Government Licence v3.0 - Cloud guide for the public sector (Central Digital and Data Office / Government Digital Service). https://www.gov.uk/government/publications/cloud-guide-for-the-public-sector/cloud- guide-for-the-public-sector Taken: The statement that no government policy directly prevents storing or processing cloud data in any specific country. Licence: Open Government Licence v3.0 - UK financial system strengthened with new safeguards for major technology providers (HM Treasury). https://www.gov.uk/government/news/uk-financial-system-strengthened-with-new- safeguards-for-major-technology-providers Taken: The four Critical Third Parties designated, effective 13 July 2026. Licence: Open Government Licence v3.0 Scope: A financial-services regime. It places no duty on a public body buying from G-Cloud and is used here as labelled context only. - UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury (Bank of England). https://www.bankofengland.co.uk/news/2026/july/uk-financial-regulators-to- begin-overseeing-critical-third-parties-announced-by-hmt Taken: Three short quotations bounding the scope of the regime. Licence: Bank of England website terms; quoted as fair reporting of a public announcement, not reused as data Scope: Financial services only. LICENCE - TWO LICENCES APPLY, AND A REUSER SHOULD CARRY BOTH 1. Source data. Crown copyright, reused under the Open Government Licence v3.0 (https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/). Attribution required, in these words: 'Contains public sector information licensed under the Open Government Licence v3.0.' 2. Servnet's derived work. The analysis, the derived columns in this file and the derived tables on the study page are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) (https://creativecommons.org/licenses/by/4.0/). That licence requires attribution as a condition, not as a courtesy: credit 'Servnet G-Cloud 15 Data Location Census 2026, https://www.servnetuk.com/research/g-cloud-15-data-location-census-2026' with a link to the study page. The same wording appears on the study page and in the Dataset schema. The Open Government Licence also excludes third party rights the information provider is not authorised to license. It covers the Crown-published catalogue. Short supplier-authored strings - a service name, its categories and the free-text answer naming the organisation resold - are reproduced as factual identifiers of listed services; the long supplier-authored service descriptions on the same pages were deliberately not republished. The licence does not cover personal data; the supplier contact panel was removed before storage and no contact field, email address or telephone number appears in any output. CONTACT Study page: https://www.servnetuk.com/research/g-cloud-15-data-location-census-2026 Corrections and takedown policy: https://www.servnetuk.com/research/corrections Corrections by email: webmaster@servnetuk.com