Findings · October 2026 · thesovereignstack.org
The Sovereign Stack

Handbook · General profile

Criteria for any solution

These apply to every piece of software at every layer, open source or not, including the incumbent's. Each section adds the criteria specific to its layer. A supplier claims each line; a buyer tests it.

The criteria are written as a view over the twelve dimensions the Findings score, so a supplier scored on the evidence side is being measured on the same facts here. The clause under each criterion is the tender text. It is a starting point for a procurement team, not legal advice.

  1. G1 Open standards

    Data in, data out and every interface use a named open standard or open format, not a proprietary format with an export button.

    Tender clause

    The supplier shall name the open standard or open format used for each data store and each interface, and shall not require a proprietary format for any data the buyer creates.

    Dimensions it measures

  2. G2 Exit

    Full export in an open format, tested before go-live, within a stated time and at no exit charge.

    Tender clause

    The supplier shall provide a full export of the buyer’s data and configuration in the open formats named under G1 within thirty days of request, at no charge, and shall demonstrate that export before acceptance.

    Dimensions it measures

  3. G3 Customer-held keys

    Encryption keys for data at rest are held by the public body, so the provider cannot read the data.

    Tender clause

    Keys protecting the buyer’s data at rest shall be generated and held by the buyer, or by a key service under the buyer’s sole control, and the supplier shall have no technical means of decrypting that data.

    Dimensions it measures

  4. G4 Operation

    Can be run on UK infrastructure by UK staff, or by any operator the buyer chooses, with administrative access under the buyer’s control.

    Tender clause

    The software shall be deployable on infrastructure and by an operator of the buyer’s choosing, and administrative access shall be granted, logged and revoked by the buyer.

    Dimensions it measures

  5. G5 Licence, owner and governance

    The licence, the owner, the owner’s country and the governance of the project are stated and sourced, so the Findings method can score it.

    Tender clause

    The supplier shall state the licence of every component, the ultimate owner of the supplier and that owner’s country of incorporation, and the body that governs changes to the software, and shall notify the buyer of any change to these within thirty days.

    Dimensions it measures

  6. G6 Security

    A vulnerability disclosure policy, a software bill of materials, signed releases and a stated support lifetime.

    Tender clause

    The supplier shall publish a vulnerability disclosure policy, supply a software bill of materials for each release, sign each release, and state the date to which security fixes will be provided.

    Dimensions it measures

  7. G7 Accessibility

    Meets WCAG 2.1 AA, which the public sector is already bound to, with an accessibility statement.

    Tender clause

    The software shall conform to WCAG 2.1 level AA and the supplier shall provide and maintain an accessibility statement in the form required by the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018.

    Dimensions it measures

  8. G8 Total cost

    Licence, run and exit costs are stated separately, so a free licence with a captive hosting fee is visible.

    Tender clause

    The supplier shall price licence, operation, support and exit separately for the whole contract term, and shall state the share of each delivered by UK-based organisations.

    Dimensions it measures

  9. G9 Multiple suppliers and UK capability

    At least two credible organisations, at least one in the UK, able to deliver or support it.

    Tender clause

    The supplier shall identify at least one other organisation able to operate and support the software, and shall not restrict the buyer from engaging it.

    Dimensions it measures

Layer-specific criteria follow the same pattern in each section, starting with Identity & access. To propose a change to a criterion, open a discussion or a pull request from the Handbook landing page.